If a website is up and running with all the accoutrements of a genuine site very few visitors to the site will double check that it is genuine. The consequences for a property insurer are probably most severe. A dummy site can gather property and household security details under the guise of a dummy proposal or claims Other insurers are in no better position if credit card details are gathered. Most pirates and blackmailers do not go to the effort of creating a site. Of course, paying the blackmailer off is not the only option.
Companies can and do sue.
The downside of this is publicity and legal costs. The risk of falling victim can be virtually eradicated if companies prevent themselves being soft targets.