I keep hearing that, and yet see mailbox hacks where the attacker tells accounts payable to update the payee's account and the money goes bye bye. Seems to turn into an insurance matter. I'm not sure why, but apparently just getting the bank to get the money back isn't so simple. Nobody talks about it in public. Haven't personally seen 8 figure amounts, but have seen amounts around a million dollars.