Facebook and Google Were Victims of $100M Payment Scam 50
Employees of Facebook and Google were the victims of an elaborate $100 million phishing attack, according to a new report on Fortune, which further adds that the employees were tricked into sending money to overseas bank accounts. From the report: In 2013, a 40-something Lithuanian named Evaldas Rimasauskas allegedly hatched an elaborate scheme to defraud U.S. tech companies. According to the Justice Department, he forged email addresses, invoices, and corporate stamps in order to impersonate a large Asian-based manufacturer with whom the tech firms regularly did business. The point was to trick companies into paying for computer supplies. The scheme worked. Over a two-year span, the corporate imposter convinced accounting departments at the two tech companies to make transfers worth tens of millions of dollars. By the time the firms figured out what was going on, Rimasauskas had coaxed out over $100 million in payments, which he promptly stashed in bank accounts across Eastern Europe. Fortune adds that the investigation raises questions about why the companies have so far kept silence and whether -- as a former head of the Securities and Exchange Commission observes -- it triggers an obligation to tell investors about what happened.
WOW (Score:1)
Re: (Score:2)
First rule (Score:4, Interesting)
First rule of damage control for corporations hit by scams like this is to NEVER disclose it happened if you don't have to. If nobody finds out about it, there won't be any damage to your reputation and there won't be copycats inspired by it.
Re: (Score:2)
Until they find it out, plus that you didn't inform the SEC, so that by now the shares will take the hit anyway.
Well (Score:4, Funny)
If huge corporations such as Facebook and Google can fall victim to scammers, who are we to even try resisting?
Help me pay for the scams I'm a victim of. Send donations directly to:
18LQHMjKSCSU3g4f29TfmtfxHXUfnh7juB (Bitcoin)
D9scjyKETYZesSmhjCR4vye4bc6iDqXPd6 (Doge)
Re: (Score:2)
Re: (Score:3)
If huge corporations such as Facebook and Google can fall victim to scammers, who are we to even try resisting?
A company's large size actually works against you, when it comes to protecting against issues like this ---- the more people you have,
the harder it is to effectively communicate a message to everyone and mobilize all the important parties against a threat....
Instead of being agile and able to adapt, you need to rely mostly on written policies, putting systems into place, and training
Re: (Score:2)
It takes systemic incompetence to fall for these well known and old billing frauds.
Hall of Fame worthy (Score:2)
Re: (Score:2)
Your sig! I love it. That is one of the things that bothers me most about normals.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Congrats sleuth slashdot users (Score:3)
Moral of the story, Greedy dude got caught.
Checking your own accounting database. (Score:2)
Isn't that SOP? It should be...
Nothing new here (Score:3)
This is and old scam updated for modern times, scammers used to send small bills for office supplies to accounting departments of large corporations hoping the bill would be paid without any checking for validity. Worked often enough that the scammers kept doing it.
Smart but dumb.... (Score:3)
I mean Russia is right there. He could have hopped over to Kaliningrad and it would be like he never really moved, nestled between Lithuania and Poland. He had enough money I'm sure he could arrange for residency.
*Yes, the US has an extradition treaty with Lithuania.
Re: (Score:2)
Are there any NATO countries that don't have bilateral extradition treaties?
Re: (Score:3)
Are there any NATO countries that don't have bilateral extradition treaties?
I don't think so. The list of countries that have treaties or other arrangements is actually surprisingly larger than I thought it would be. The no-treaty list is pretty short. Even shorter when you remove the places that are dangerous and/or third-world.
Re: (Score:2)
Re: (Score:2)
Re: Smart but dumb.... (Score:3)
Paradoxical. (Score:5, Insightful)
the investigation raises questions about why the companies have so far kept silence and whether [...] it triggers an obligation to tell investors about what happened.
The problem is that disclosure is paradoxical.
1) Scammed corporations need to tell their stockholders because if the information is found out, it could negatively affect the value of the stock therefore it's in the interest of the stockholders to be told.
2) By covering it up, corporations prevent the stock from dropping and thus maintaining the value of the stock which is in the interest of the stockholders therefore the information should be withheld from stockholders.
Until a legislative imperative resolves this paradox, corporations will take the path that aligns with their own interests.
Common (Score:5, Informative)
Taken individually, these attacks are usually pretty easy to spot. But when you're hit with so many of them over the years, even if you catch 99% of them, a few will slip through.
Re: (Score:2)
For the scam to work at all they need a US address. Ain't nobody gonna fill out a SCE "bill" and
Re: (Score:2)
Letters masquerading as subscription renewals for things you haven't actually subscribed to. They're hoping someone in accounting doesn't know you haven't actually subscribed to it, assume it's a renewal so they won't investigate it to see if it's legit, and just pay it. /quote
Back in the day "International Fax Directories" were always a popular one. If the scammer had enough chutzpah, they would almost immediately follow up with a "legal letter" demanding payment, on the basis that they hadn't received a cancellation notice. This can be surprisingly effective if you direct it at law-abiding businesses who are paranoid about getting on some sort of credit blacklist.
Flying under the radar? (Score:2)
$100M? Seems like someone got greedy. Wouldn't it make more sense to keep the amounts smaller, maybe fly under the radar? To quote Hans Gurber "Well, when you steal $600, you can just disappear. When you steal 600 million, they will find you..."
How much would it take to live comfortably for the rest of your life in Lithuania? Given that the median annual income is $5,000, $100M seems a bit overkill.
Re: (Score:2)
To the contrary: go big or go home.
As the post from Solandri above points out: small scammers ask for 200 dollars.
Those are easily caught because The Big G probably don't buy small quantities of anything.
But send an invoice for 3 million and... "Hey, I'm not supposed to tell you this but manager X needs this gear for this super-secret, super-important project. You know, he's reporting directly to Sergej and Larry on this one. No red tape, no fuzz. Now do the needful and approve the payment so we both don't
Encryption? (Score:2)
According to the Justice Department, he forged email addresses, invoices, and corporate stamps in order to impersonate a large Asian-based manufacturer with whom the tech firms regularly did business.
Of all the companies in the world, I expected Google to have established some method of identification of their suppliers more secure than email addresses, invoice formats, and corporate stamps. PGP is now 26 years old, and the algorithms it implemented are older yet. It's really really time for businesses to start using those algorithms, if not PGP itself.
I'm envisioning a system where, during the meeting when a contract is signed, the principals exchange public keys, maybe going so far as printing them
Re: Encryption? (Score:1)