2019-12-19 (sentenced), Date the court's restitution order was filed; SecurityWeek reported the sentence the same day. · US · Google and Facebook

Evaldas Rimasauskas sentenced for fake invoice fraud on Google and Facebook, 2019

Sentence handed down.

Evaldas Rimasauskas, a Lithuanian national, registered a company in Latvia with a name resembling Quanta Computer, a Taiwan-based hardware maker, and from 2013 to 2015 he and others sent emails and fake invoices to employees of two US internet companies asking for payments to bank accounts in Latvia and Cyprus, from which money was moved on through several countries. Google and Facebook confirmed in 2017 that they were the victims. Rimasauskas was arrested in Lithuania in March 2017, extradited to the United States, pleaded guilty to wire fraud in 2019 and was sentenced to five years in prison, with forfeiture of about $49.7 million and restitution of about $26.5 million.

$122M (stolen; About $99 million wired by Facebook and $23 million by Google, as reported by Sophos. Google said it recouped its funds and Facebook said it recovered the bulk of its funds.)

Timeline

1. 2013-01-01 From 2013 the scheme sends payment requests posing as a hardware supplier, continuing until 2015, SecurityWeek reports.
2. 2017-03-21 The indictment against Rimasauskas is unsealed in the Southern District of New York, following his arrest in Lithuania.
3. 2017-04-01 In April 2017 Google and Facebook confirm they were the companies targeted.
4. 2019-03-20 Rimasauskas pleads guilty to a wire fraud count, according to the court docket.
5. 2019-12-19 The court orders restitution; Rimasauskas is sentenced to five years in prison.

Lessons

• Verify any change to a supplier's bank details by calling a known contact at the supplier, never a number in the email.
• Check that the legal entity and country on a payee account match the supplier you actually contract with; here a Latvian company mimicked a Taiwanese one.
• Report and act fast: Google said it detected the fraud and promptly alerted the authorities, and both companies recovered most of the money.

Scam types: Vendor invoice and payment redirection · Techniques: Email phishing

Sources

1. United States v. Rimasauskas, No. 1:16-cr-00841 (S.D.N.Y.), docket (Court record, primary, accessed 2026-09-24)
2. SecurityWeek: Lithuanian man sentenced to prison over BEC scheme targeting Facebook, Google (News report, secondary, accessed 2026-09-24)
3. Sophos: Man jailed for $122 million scam that fooled Google and Facebook (News report, secondary, accessed 2026-09-24)