Because every successful fraud makes the crime that much more attractive and turns it into a bigger problem. I may not be able to do much, but I have no desire

Because every successful fraud makes the crime that much more attractive and turns it into a bigger problem. I may not be able to do much, but I have no desire to have my identity stolen and I'd rather put up with a small inconvenience than trust in a site I know to be utterly incompetent based on their setup alone. If you won't allow characters like < and > in passwords and you have a maximum length, I thereby presume you're storing them in plain text in your DB and that you lack the competence to avoid XSS. Having helped people from big companies address the findings in PCI audits they bring me, I know just how bad some of them are when they should know better. It should not take a highly paid consultant to tell people to disable export ciphers and they shouldn't have to tell anyone the same things on different ports two years in a row. So yeah, I don't care if I'm liable for fraud or not, I don't want to make it easier and I don't want to be the guy whose identity gets stolen, nor to reward sites that make it easy for criminals to thrive.