I have a friend who is of the opinion that it is impossible for his accounts to be hacked. Not unlikely, not difficult. Flat out impossible. He also says he doesn't care at all if his credit card numbers are stolen, as he'll just cancel the card and get a new one.

This is someone who is a near full time user of Facebook and G+

With that kind of attitude, how do you even approach IT security?