It’s so easy to get a password from most people. And then it’s bad.

If a bad guy gets a users password, even a low level employee, the consequences are generally very expensive and the damages hard to recover from. They often go after the firms clients/customers, employees and vendors as well using email and other resources to appear as though it is you sending them payments or asking them for information.