Hamster, it is the generally accepted practice to force a user to change their password every 90 days in the financial industry. So that is what I would recommend. Every 90 days.