Is it legal for them to make me create passwords for a customers account?

I work for a cell phone company. When a customer signs up for our cell service, my employer is forcing me to automatically in our system, create a username, and password on the customers account. We are then instructed to write the password, and username down for the customer so when they download the app at a later time they're able to sign-in. We are instructed to do so whether the customer requested or not. The employer is also requiring me to take a picture with my personal phone, and post it to our company group app. Is it legal for them to make me create passwords for a customers account? Secondly, can a company force me to use my personal phone for their company business when it's wasn't required when I was hired?