Super-crook admits he nicked $122m from Facebook, Google by sending staff fake invoices for tech kit A Lithuanian citizen extradited to the US has admitted bilking $122m from Facebook and Google by sending the tech giant's staff bogus invoices for computer gear. Evaldas Rimasauskas, 50, changed his plea from not guilty to guilty in a New York court this week, and said he knew what he was doing was fraudulent. He yesterday …
This post has been deleted by its author
If they are ordering billions in gear each year, 30 million a year for each company might well be below the radar. Not that they wouldn't notice it, but they'd assume someone fat fingered an invoice number and it would resolve itself eventually. Probably no one at Google/Facebook was personally invested in it enough to dig deeply until it became big enough for the Cxx suite to notice. It isn't like it is their money.
To be honest when reading the story I was looking at the opposite view. I was surprised they noticed and was wondering how they did.
These companies must be dealing with millions of invoices and they would be dealt with by regular accounts assistants and accountants that have a specific procedure to follow. If he knew the procedure and complied with it then he got paid and, crucially, appeared to be a current supplier on their system.
Most audits would be a random sample. There would be a big range of PO and non-PO orders. There'll be a lot of R&D, a lot of sub companies and mergers, loads of hardware purchases, sub contractors. Keep the invoices under the specific limit that needs proper scrutiny from high up and he was unlikely to be noticed.
The one that should have been picked up on was the 'send money to this bank account from now on' request. Even I never accept a written letter or email to request that - I always ring my contact to check that it is correct as it is a fairly rare occurrence and it is prime for faking.
Yes, the way most large companies are organized - and it's hard to get this right - there is one set of people in charge of basically ordering stuff, receiving it, testing it and so on - usually they'll send instructions to "accounting" or "procurement" who will do the order, and then pay the bill later on.
Note that the group needing the gear itself and the group handling the money may never meet or even be on the same continent, there is no check of "did this thing I order come in" other than the gear guys asking accounting.
But if no one at the gear level ordered a thing, which then does not arrive - they have no knowledge or reason to tell the money people that what they never asked for never came....
This is a classic man in the middle attack....
In order to do a credible job, he'd have to know what Quanta's real invoices look like, what bank they use when dealing with Google/Facebook, what kit Google and Facebook are ordering so the invoices seem reasonable, etc.
He had to have help within one or more of those companies, or at least have compromised some email accounts so he could see the real emails.
This sort of fake invoicing predates computers. It may even predate the industrial age - want to bet it didn't happen in Rome under the Caesars? It is easier with inside help but if you send off enough fakes sooner or later one will be processed by someone lazy or stupid.
When I was working for the Greater London Council I received an invoice for maintenance for some computer kit I didn't recognize. When I went to look for the stuff I found the room specified appeared to be a Ladies toilet. This was some time ago ... the GLC was abolished in 1986.
Ah yes, how often do we see that in scams.
If they'd just raked in a few million and quickly laundered the shit out of it and then stopped, they'd probably still be living the good life today.
I recall a woman in Australia who fleeced the local council out of a large sum and then invested it in LOCAL real estate, instead of quickly heading for Asia or South America. In that case she was a pretty astute investor and the authorities actually recovered more than she initially stole.
Extremely cooperative, not all the money recovered? If he did it right he laundered some of the money into an investment account where it's clocking up cash by the thousands eavh day. If he flips on the rest of his team, he gets a year or two at a minimum security resort prison, then finds a nice tropical island to spend the rest of his life with the cash he has left.
Not a bad way to do it, if you're criminally minded.
Back in the early 80's, at a publicly listed top 300 company, £100's millions a year t/o it was the head of purchasing that was creating, and paying, the fake purchase invoices. While it lasted.
Best part of it? She was the FD's auntie.
AC for obvious reason and to protect the innocent.
"Facebook recovered the bulk of the funds shortly after the incident and has been cooperating with law enforcement in its investigation."
Funny that the only time they (and probably Google) "co-operate with law enforcement, etc. is when they're a victim. Unlike when they sell everyone's brother, sister, mother, father and family dog details to the highest bidder.
I say law enforcement shouldn't be cooperating with Facebook until Facebook decides to adhere to the law and cooperate with law enforcement when investigated. Or at least hold the money in escrow for the inevitable future fines. But I guess Facebook et al would just shrug and let it go, some measly tenmillions compared to the fines at play...
Coming to think of it, hasn't the guy Rimasauskas just set out to recover the money Facebook and Google made on selling his life?
AFAIK, when the invoices were questioned, he claimed it was hardware for a secret project aligned directly under the CEO's office and details were "need to know".
That shut up most of the nosy beancounters, apparently.
BTW: our boss is said to have a habit of checking all invoices about the equivalent of 100 USD, personally.
At least he did until recently.
We don't think it's a good use of his time, but it's his company.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
