Who'd input the credit card on a random website that has suspicious discounts? Who'd give his SSN through the phone to someone saying the bank is calling to verify some details? Who'd believe an email saying that it's the bank and you need to update your app ASAP by clicking on this link or you'll lose access to your account?

They (or we) are not stupid, they just don't know better and we should try to shield them from these risks as much as possible.