Phishing Documented incident

Evaldas Rimasauskas: the $122M Google and Facebook invoice scam (2013 to 2015)

Evaldas Rimasauskas posed as supplier Quanta Computer to get Google and Facebook to wire about $122M. How the fake-invoice scam worked and what came back.

Social Engineering Examples·9 sources

Evaldas Rimasauskas, a Lithuanian, ran one of the biggest business email compromise scams on record. Between 2013 and 2015, his ring pretended to be Quanta Computer, a real Taiwanese hardware supplier, and talked Google and Facebook into wiring about $122 million to bank accounts in Latvia and Cyprus. No systems were hacked to move the money. Finance staff paid what looked like normal supplier invoices. Status: Documented incident.

Key takeaways

The trick was a look-alike company. Rimasauskas registered a firm in Latvia with the same name as Quanta and opened bank accounts in that name.
Google got all of its roughly $23.3 million back. Facebook recovered most of its $98.9 million, but about $26.5 million was still outstanding at sentencing.
The court papers never name Google or Facebook. The companies confirmed it themselves to NPR in 2019.
Rimasauskas pleaded guilty to wire fraud and got five years in prison in December 2019.

How the Google and Facebook scam worked

Homework, for about two years. The FBI says the ring rang customer-service lines to collect names of key staff, and sent phishing emails to get a look inside email systems.
A twin company. Rimasauskas set up a company in Latvia with the same name as Quanta Computer, which Google and Facebook really did buy from. He opened accounts for it at banks in Latvia and Cyprus.
The ask. Emails built to look like they came from Quanta staff told finance teams to send money they already owed Quanta to the new accounts. Nothing new was being bought. Only the bank details changed.
Paperwork for the banks. Here's the clever bit. The forged invoices, contracts and letters carried Google's and Facebook's own fake signatures and stamps, and went to the receiving banks. That made nine-figure deposits into a fresh shell company look like ordinary business.
Cash out. As soon as money landed, it was wired on through accounts in several countries to make it harder to claw back.

One detail is disputed. The FBI's account says a fraudster also phoned the companies to ask for the bank change. The indictment and both DOJ press releases only mention emails. This page records the conflict rather than picking a side.

What the court records say, and what the press added

Detail	Source	Status
Same-name Latvian shell, Latvia and Cyprus accounts, 2013 to 2015	Indictment	Confirmed
$23.26 million from Victim-1, $98.87 million from Victim-2	Sentencing transcript	Confirmed
Victim-1 is Google, Victim-2 is Facebook	NPR, from the companies	Confirmed by the companies, not the court
Quanta Computer was the supplier being copied	Reuters	Confirmed by Quanta
Recon by phone and phishing over two years	FBI	FBI account

The money: wired, recovered, lost

About $122.13 million went out in total. Google's share, roughly $23.26 million, came back after a civil fraud case in Latvia. "We recouped the funds," a Google spokesperson told CNBC. Facebook said it "recovered the bulk of the funds shortly after the incident", since much of its $98.87 million was frozen when the wires were spotted.

What wasn't recovered: $26,479,079.24, all of it Facebook's, which the judge ordered Rimasauskas to repay as restitution. Prosecutors told the court most of that was gone, with about $5 million frozen. He also agreed to forfeit $49,738,559.41. That's a separate order, roughly what Reuters says he personally pocketed. Adding the two together would double count.

Tip: "over $100 million" and "$120 million" both appear in headlines. The exact court figure is $122.13 million wired, and the final loss was far lower.

Timeline

Date	Event
2013 to 2015	The ring sends fake Quanta payment requests; Google and Facebook wire about $122 million
March 2017	Rimasauskas is arrested in Lithuania
August 2017	Extradition to New York
20 March 2019	Guilty plea, one count of wire fraud (DOJ)
19 December 2019	Five years inside, two more supervised (DOJ)

What would have stopped it

A phone call. Any change to a supplier's bank details gets checked by ringing a number you already had, never one from the email.
A geography check. A Taiwanese supplier suddenly paid in Latvia and Cyprus should trip an alert, however good the paperwork looks.
A second pair of eyes, plus a day or two's hold, before money goes to a new or changed payee.
Spotting the twin. If a "Quanta" turns up in your vendor records registered in Latvia, someone should ask why.
Reporting fast. Quick calls to banks and the FBI are why so much of the money was frozen.

More on this: invoice fraud, the wider BEC picture, and checking a wire before it goes.

Common questions

Who is Evaldas Rimasauskas?

The Lithuanian behind the fake-Quanta scam. Google and Facebook sent his ring about $122 million between 2013 and 2015. He admitted it in 2019 and got five years.

How much did Google and Facebook lose?

Google got its roughly $23.3 million back. Facebook recovered most of its $98.9 million; about $26.5 million was still outstanding at sentencing.

Was this phishing or BEC?

Both words get used. It's business email compromise, specifically invoice fraud: fake supplier emails asking for payment to new bank details. Phishing was also used earlier to gather inside information.

Why didn't Google's and Facebook's security catch it?

Nothing technical was broken. Staff paid what looked like a real, expected supplier invoice. The weak point was the payment process, not the software.

Sources

Lithuanian Man Pleads Guilty To Wire Fraud For Theft Of Over $100 Million In Fraudulent Business Email Compromise Scheme. U.S. Department of Justice, U.S. Attorney's Office, Southern District of New York (primary). DOJ press release, 2019-03-20, announcing the wire-fraud guilty plea. Live fetch blocked by Akamai bot protection; verified against three independent full-text republications of the release, which agree word for word. It confirms the guilty plea and the over $100 million figure. Note that $100 million is the only dollar amount anywhere in this release: the forfeiture and restitution amounts come from the December 2019 sentencing release, not this one.
Lithuanian Man Sentenced To 5 Years In Prison For Theft Of Over $120 Million In Fraudulent Business Email Compromise Scheme. U.S. Department of Justice, U.S. Attorney's Office, Southern District of New York (primary). DOJ press release, 2019-12-19. Live fetch blocked by Akamai bot protection; verified via Wayback Machine archive capture. Confirms the 60-month sentence, two years of supervised release, forfeiture of $49,738,559.41 and restitution of $26,479,079.24 as two separate judgments, the laundering destinations, and that the forged documents bore the victim companies' own executive signatures and corporate stamps and were submitted to banks. The release does not mention the judicial order of removal; that is in the sentencing transcript.
United States v. Evaldas Rimasauskas. Sealed Indictment (16 CR 841, S.D.N.Y.). U.S. Department of Justice / SDNY (grand jury indictment) (primary). Fetched successfully. Charging document confirms the BEC mechanics: same-name Latvian shell (Company-2), emails sent from accounts "designed to create the false appearance" of coming from the Asian vendor (Company-1), Latvia/Cyprus accounts, 2013 to 2015 timeframe. It describes Company-1 only as "an Asian-based manufacturer of computer hardware" that provided goods and services to technology companies; it does not describe what Quanta specifically built for the victims.
United States v. Rimasauskas. Sentencing Transcript, Dec. 19, 2019 (16 CR 841, GBD). U.S. District Court, S.D.N.Y. (via CourtListener/RECAP) (primary). Fetched successfully. Court transcript confirms exact figures: $120M intended loss (stated in court), $23.26M (Victim-1) and $98.87M (Victim-2), $26,479,079.24 outstanding restitution of which "approximately $5 million" was frozen and the majority lost, Victim-1's funds returned after the Latvian civil fraud proceeding, the 60-month sentence, funds frozen in Cyprus, and the judicial order of removal. The transcript never names Google or Facebook; it says only Victim-1 and Victim-2.
Sentence in BEC Scheme. Leader of Fraud Ring Sentenced. Federal Bureau of Investigation (primary). Fetched successfully. FBI first-party account, 2020-01-28, confirms the two-year recon effort (customer-service phone pretexting, phishing for email access), the forged paper trail, that investigators "froze some of the funds," and the IC3 figure of more than $10B in reported BEC losses from 2013 to 2019. This account conflicts with the charging documents on one point: the FBI says "one of the fraudsters simply called the companies pretending to be a vendor" and "told each company to change their bank account information," where the indictment and both DOJ releases describe the ask arriving only by email. The case page names the conflict rather than resolving it.
Lithuanian pleads guilty in U.S. to massive fraud against Google, Facebook. Reuters (secondary). Fetched successfully. Confirms victim identities (Google/Facebook), the $49.7M forfeiture, and (per Exa search excerpt) that Quanta confirmed its name was used and a 2017 Lithuanian court order identified Google and Facebook as the victims, since the DOJ documents themselves left both unnamed.
Man Pleads Guilty To Phishing Scheme That Fleeced Facebook, Google Of $100 Million. NPR (secondary). Fetched successfully. 2019-03-25. The source of the victim mapping the court record omits: "The indictment does not identify Google and Facebook by name, but the two tech giants confirmed to NPR they are Victim-1 and Victim-2, respectively." Also reports that both companies said they recouped all or most of the money. Its per-company dollar split is attributed to Bloomberg and "a person familiar with the case," a single anonymous source, so this page takes the split from the sentencing transcript instead.
Phishing email scam stole $100 million from Facebook and Google. CNBC (secondary). Fetched successfully. 2019-03-27. Carries the on-record recovery statements from both victims: a Google spokesperson, "We detected this fraud and promptly alerted the authorities. We recouped the funds and we're pleased this matter is resolved," and a Facebook spokesperson, "Facebook recovered the bulk of the funds shortly after the incident." The same quotes appear in Gizmodo, Fortune and the NZ Herald, so they are corroborated rather than single-sourced. CNBC also independently describes the forgeries as aimed at the banks.
He Tried to Bilk Google and Facebook Out of $100 Million With Fake Invoices. The New York Times (secondary). Fetched (partially, paywalled beyond preview); visible content and byline/date confirm it is a genuine NYT piece corroborating the fake-invoice method, Quanta Computer impersonation, and Rimasauskas's guilty plea.

Cite this case

Social Engineering Examples. “Evaldas Rimasauskas: the $122M Google and Facebook invoice scam (2013 to 2015)”. Accessed 3 November 2026. https://socialengineeringexamples.com/rimasauskas-google-facebook-bec-2019

Attack Chain & Defense

1Reconnaissance

What happened

per the FBI's own account of the case, the ring spent roughly two years researching the target companies, including calling the victims' customer-service lines to harvest names and contact details of key employees, consistent with typical pretexting-driven OSINT gathering.