This is literally what social engineering is all about - no need to "steal" when you can just ask nicely. Like 80% of breaches involve some form of social engineering because humans are almost always the weakest link in security. No fancy hacking required when people just hand over the keys to the kingdom.