What made me curious is how did you end up talking to this guy (for a few months) in the first place?
And 12.5BTC as a reward seems way too good to be true.
When you have this feeling you already know that the situation won't end well.
yes, you have to change your password, it will secure your assets, you should be careful, when you get BTC easily, you must suspect the results.
There's no point in changing the password, bl4nkcode already mentioned that it's a watch only address even if OP did change it his "friend" most likely have a backup. This type of scam has been going on for a while now and everyone should be more cautious before trusting people right away.