For a lot of companies, it's not a real risk until it actually happens. In other words, despite thousands of years of scams, people still get scammed.