If they intended to give me root access to the account, then yes. In the much more likely case that it was unintentional, I should badger them until they change their password. If they gave me the password unwillingly (eg, because they wanted me to deal with financial issue for them and their bank doesn't support more fine-grained authorization), same caveat. In either case, the problem is that the bank thinks that "[password]" is something only they know, and the solution (changing their password) has nothing to do with anything I actually do with the information, aside from (not) lying to the bank about my identity/money-ownership.