an invoice from a known supplier is genuine

what everyone assumed

Accounts-payable runs on a reasonable shorthand: a bill from a vendor you recognize, referencing work you actually contracted, is almost certainly real. That is how the volume gets handled at all, and it is how the controls are designed, with the supplier’s identity standing in for a deeper check. The belief held perfectly well for every genuine invoice that ever came through, which is exactly why the fake ones moved with it.

what happened

Between 2013 and 2015, Evaldas Rimasauskas ran the same play over and over. He registered a company in Latvia using the name of Quanta Computer, the real hardware supplier the two companies worked with, then sent invoices, contracts, and letters that matched what a legitimate Quanta bill would look like, complete with forged corporate stamps and signatures. The payments went out to bank accounts he controlled in Latvia, Cyprus, and elsewhere, then moved on again. There was no break-in and no malware, just a familiar name on a believable invoice, repeated patiently until the totals were enormous. Each payment, on its own, looked exactly like the routine ones around it.

how it surfaced

By the time it surfaced, the scheme had induced the two companies to wire out more than USD 120 million, with about USD 99 million coming from Facebook and about USD 23 million from Google. Rimasauskas was arrested in Lithuania in 2017, extradited, and pleaded guilty to wire fraud in March 2019. In December 2019 a federal court in Manhattan sentenced him to 60 months in prison and ordered forfeiture and restitution. Much of the money was recovered, which is the unusual part. The ordinary part is how far a real supplier’s name traveled before anyone questioned it.

A familiar name on an invoice is not proof of who sent it.

The only thing that confirms a payment instruction is a check that runs outside the message, against a channel the sender does not control.