[UPDATE] Man Tricked Facebook, Google Employees Into $100 Million Phishing Scam

A report named "Man Tricks Two Big US Tech Companies Into $100 Million Phishing Scam" was published on March 23 to recall how a 48-year old man from Lithuania, named Evaldas Rimasauskas, was successful in making two big US tech companies wire a total amount of $100 million over two years. In an update, the names of the companies have been revealed as Facebook and Google as per a report by Fortune.

According to the Department of Justice, the incident took place from at least in or around 2013 through in or about 2015. Here is how he did it according to the Department of Justice:

1) Rimasauskas registered and incorporated a company in Latvia (“Company-2”) which bore the same name as an Asian-based computer hardware manufacturer (“Company-1”), and opened, maintained, and controlled various accounts at banks located in Latvia and Cyprus in the name of Company-2.

2) Thereafter, fraudulent phishing emails were sent to employees and agents of the Victim Companies, which regularly conducted multimillion-dollar transactions with Company-1, directing that money the Victim Companies owed Company-1 for legitimate goods and services be sent to Company-2’s bank accounts in Latvia and Cyprus, which were controlled by him.

3) These emails purported to be from employees and agents of Company-1, and were sent from email accounts that were designed to create the false appearance that they were sent by employees and agents of Company-1, but in truth and in fact, were neither sent nor authorised by Company-1. This scheme succeeded in deceiving the Victim Companies into complying with the fraudulent wiring instructions.

After the Victim Companies wired funds intended for Company-1 to Company-2’s bank accounts in Latvia and Cyprus, Rimasauskas caused the stolen funds to be quickly wired into different bank accounts in various locations throughout the world, including Latvia, Cyprus, Slovakia, Lithuania, Hungary, and Hong Kong.

He also caused forged invoices, contracts, and letters that falsely appeared to have been executed and signed by executives and agents of the Victim Companies, and which bore false corporate stamps embossed with the Victim Companies’ names, to be submitted to banks in support of the large volume of funds that were fraudulently transmitted via wire transfer.