Plus, many of the new rules were targeted at kinds of fraud that have actually been perpetrated. If you don't patch a security hole, people won't get tired of exploiting it. They'll just keep on exploiting it until you do something to make it harder or more dangerous.