Not having a 'no asking for passwords' policy is just as bad. Most companies with online an online presence will tell you in their form emails that an employee will never ask you for the password. This one not only doesn't, but obviously regularly asks for a password.