Man Stole $122M from Facebook and Google by Impersonating Quanta

https://boingboing.net/2019/03/24/evaldas-rimasauskas.html

by paulgerhardt • 7 years ago

242 93 7 years ago

sschueller• 7 years ago

This is very similar to these domain renewal or the trademark renewal invoices spam letters that you get in your mail.

They look very legitimate but are actual from other companies just sending you a bill for something that you don't owe.

I assume many smaller companies with untrained staff pay these items without double checking and that is why these things still come int he mail.

I find the "trademark renewal" ones especially devious as they come from a company called something like "US Trademark Renewal services" and the invoices look like they come from a federal agency.

Waterluvian• 7 years ago

You'd think that impersonating the government is the best way to get the DOJ on you, but I suspect they really lack the resources.

delinka• 7 years ago

Indeed it is illegal and you'll definitely get into trouble with some law enforcement agency if you impersonate the government. But there's not a US Trademark Renewal Services Department to impersonate. You can name your company anything that's not already someone else's property or the name of a governmental body.

Are these companies despicable? Yes. Are they misleading people? I'd say so. Can you make a fraud charge stick? Probably not. In cases I've seen, if you read the entire document, including fine print, and you think logically about the content, you can deduce that the companies sending these notices/invoices/wtfe are just hoping the target isn't savvy enough to figure things out.

baybal2• 7 years ago

In Russia, we had "pay us 1m dollars or we kill you spam." Unsettling it is, given that once in a million times, the threat carried is true.

That was one of many many things that made me leave.

analog31• 7 years ago

I've gotten ones claiming that I have to send money in order for one of my patents to be registered in some particular country, typically eastern Europe.

asaph2• 7 years ago

...these domain renewal or the trademark renewal invoices spam letters that you get in your mail.
They look very legitimate...

The ones I've seen do not. And I stopped receiving them altogether a few years after I made my domain name registrations private.

reaperducer• 7 years ago

I stopped receiving them altogether a few years after I made my domain name registrations private.

I keep my registrations public, as they should be. But I stopped getting those letters when I changed the phone number to a VOIP service in another country.

sokoloff6• 7 years ago

Whenever you get annoyed by a tedious paperwork exercise to buy something in your company, it helps to realize that crap like this is (part of) why those processes exist.

Scoundreller4• 7 years ago

In my experience, it’s just motivation to spend your own money on it. Much less frustrating.

I spent too much time trying to get that 25’ RJ-11 cable to avoid that tripping hazard. Best $2 I ever spent.

sokoloff6• 7 years ago

Most sensible places have an expedited process for employees for things under some trivial amount (ours is $25).

dmix2• 7 years ago

Are you saying Google didn’t follow such a process and that is the solution?

sokoloff6• 7 years ago

Not at all. I'm saying that those annoying processes are intended to provide enough information to match up legitimate purchase orders to goods/services receipt to invoices.

Whether AP uses that information is a related but distinct matter. The processes are a necessary, but not sufficient, condition.

baddox• 7 years ago

It seems like tedious paperwork exercises would make it easier for scams like this to happen, since there’s no one person with the responsibility to say yes or no to specific purchases/invoices. If the responsibility is placed on the bureaucratic process rather than specific people, surely that’s going to make it easier for bad stuff to slip through (while also making it more challenging to get legitimate requests through).

sokoloff6• 7 years ago

What is intended to happen is someone fills out a vendor creation form (to guard against paying the wrong vendor/bank account), fills out a PO, later someone agrees they received goods or services against that PO, later AP receives an invoice, AP checks against the PO that goods/services have been received in the amount of the invoice, and pays the invoice to the previously setup vendor information.

When properly followed, the process makes scams harder, not easier. If people don't follow the process...

(You can look at this as the process having one person responsible for each step in the process, with the system recording each step.)

cosmodisk• 7 years ago

While the numbers are impressive,this kind of stuff can be easily done to a lot of companies. If a company lacks proper PO system or things often get done in excel instead of CRM/ERP or similar software, it's pretty tricky to chase all the ends properly. I personally seen many examples where legitimate suppliers double invoice,enter random amounts or inflate them by quite a lot.And these suppose to be the people you are having business with.

captn3m0• 7 years ago

I’m surprised he went with 100M+ amounts. At that large numbers, you have to be sure that you are gonna get caught.

Why not settle for smaller change and call t quits?

Scoundreller4• 7 years ago

Maybe nobody did before (other than obvious Nigerian prince scams), and so they slipped through unexpectedly.

inuhj• 7 years ago

We don't know that the person being prosecuted is the ultimate recipient of the funds. He could very well be the fall guy.

azhenley2• 7 years ago

If only he had put his social engineering skills and boldness towards something positive.

jarfil• 7 years ago

If he got $120M over 3 years, there aren't many jobs out there which would pay $40M a year. And if you can just send invoices and get paid, why even do any work, like ever?

azhenley2• 7 years ago

Morals? Karma? Guilt? The desire to do something meaningful? The risk of getting caught?

He did get arrested after all.

ada1981• 7 years ago

Like becoming a CEO!

dboreham• 7 years ago

Given how hard it can be to get a legitimate invoice paid, this is frustrating to hear.

GBiT3• 7 years ago

I'm from Lithuania, he is a Lithuanian citizen. What is interesting, that his wife told, that he is not capable to do this, because he was a small businessman in the construction business. His wife told, that he doesn't know how to use a computer properly for things like banking etc... USA asked for the extradition of this person, and my country gave him up, but he never was in USA.

The only thing he said, is that he meet some guy in Russia, who wanted to do some business with him. It seems, that he was just a proxy. He never saw money...

It's a very interesting story to look into because its not so simple how it looks from this post.

https://translate.google.com/translate?sl=lt&tl=en&u=https%3...

megous• 7 years ago

He plead guilty and returned $50M. He also didn't have to be a computer hacker, just able to set up company and bank accounts abroad.

calibas• 7 years ago

It's "social engineering" part of information security and technically hacking. Smooth talking is often far more effective than "computer hacking".

UncleEntity3• 7 years ago

I, for one, would blame "some guy in Russia" if the alternative was 30 years in prison...

...then plead guilty to all counts.

sridca• 7 years ago

Yes, but do we know the facts of the situation?

GBiT3• 7 years ago

Well, I'm not saying he is not guilty, he is at some point, but this story is more than it says. It's possible he was only proxy. I see some comments say here, that with his talent he could do more, but he was only some none name construction businessman.

But basically, in US I see, that a lot of people pleads guilty then it is more to the story. We don't know how much he will get for this and what deal he has. We see story, then person pleads to guilty and has to pay hundred million to later see, that they had other deal for him to pay just a few hundred thousands.

coldtea4• 7 years ago

Would you, for one, please guilty to all counts and get 10 years if you were innocent, if the alternative was to e.g. risk being found guilty and get a prosecutorial suggested 30 years?

ChuckMcM• 7 years ago

Pure speculation here based on your comment:

What you describe is called "being a cutout", that is a person who is a proxy for the "real" person who committed the crime. If what you say is accurate, that there was a more sophisticated person who did the crime, there is motivation on his part to plead guilty and stop any further investigation with the assurance that the other party will take care of his family while he serves his time. (At least that is how it has worked in the US with organized crime from time to time). If you step back from the deed itself and look at the bigger picture, if they guy has never been charged before he probably gets a fairly light sentence (not Manafort light, but probably not 30 years), he comes out of it with his family taken care of, the real crook has $73M somewhere safe, and this guy probably doesn't have to work any more if he doesn't want to.

bradleyjg2• 7 years ago

USA asked for the extradition of this person, and my country gave him up, but he never was in USA.

International law, in the form of the passive nationality principle, recognizes criminal jurisdiction in the country of which the victims are nationals regardless of whether the criminal has ever set foot there.

londons_explore3• 7 years ago

Sort of odd to choose the victims location rather than the criminals location...

nullc• 7 years ago

Facebook and Google can't keep their money safe, why does anyone think they can keep anyone's data safe?

tehlike2• 7 years ago

It is true for anything that involves humans at any point.

Google, compared to everyone else, is probably best positioned to protect it.

Disclaimer: google employee, but opinion above is my own.

jlarocco3• 7 years ago

"Trust me, I'm a google employee, we're probably better than other companies!"

Well I'm convinced.

joshuamorton2• 7 years ago

Different processes.

Why would you assume the security around user data and around invoices are at all similar?

908087• 7 years ago

Facebook was just caught with their pants down after logging passwords in plain text for years. Why would you assume they aren't?

everdev• 7 years ago

He's agreed to forfeit about $50m. It's not clear what's happened to the other $73m

I wonder if he was doing this on behalf of someone else? A few million is more than enough to live comfortably for the rest of your life in Lithuania. $122M seems like an addiction or an organized crime ring.

dmix2• 7 years ago

If anything he should have took his $50M and moved to Russia or some other country without an extradition treaty. His biggest mistake was staying in Lithuania.

ben1040• 7 years ago

This sounds like the old copier toner social engineering scam at Google scale.

Some random employee would get a call from someone claiming to be from the copier toner supplier, asking for the name of the person in charge of buying that stuff.

The pretext might be their files got mixed up and they want to straighten it out, or maybe they're a prospective supplier who wants to beat whatever price you're paying now.

Then they make a fake invoice with that name, mail it to the company's accounts payable desk, and hope it gets paid.

paulpauper• 7 years ago

This is an example of someone who devises a smart scheme but messes up in the most important stage: keeping the money and getting away with it. Should have just stopped at $10 million or so and moved it into bitcoin and then go on the low-down until statue of limitations passes or change identity or move to non extradition country. Tons of options. . .

redleggedfrog• 7 years ago

Or they could've done something different with their lives other than be scum-sucking criminals.

Gpetrium• 7 years ago

It likely takes quite a bit of willpower to not touch the money for X amount of years. In the meantime, most people are rationalizing why they wouldn't get caught and how it could enhance their lifestyle today.

_trampeltier• 7 years ago

To buy an EU passport is easy and legal in a couple of countrys (cheap in Malta, expensive in Austria).

roywiggins2• 7 years ago

He's Lithuanian, he already has one.

burtonator• 7 years ago

My company, which is small, gets these forged invoices from time to time.

Some of them are pretty good but we're smaller so we're able to see that we're not actually doing business with these companies.

EGreg• 7 years ago

This reminds me of a dude who robbed banks by simply slipping a note to the teller asking for money, with no threats. He got it many times.

pje• 7 years ago

Folk hero, TBH

jondubois• 7 years ago

Just another reason why corporations should be broken up. The idea that they can so easily transfer that kind of money in a small number of transactions is dangerous.

onetimemanytime• 7 years ago

fraud is bad and illegal.

stealing is bad and illegal.

But if you're going to do it, do it this way! A++

forinti• 7 years ago

When McNamara arrived at Ford, its accounting was in such a bad state that they weighed batches of invoices in order to have some kind of verification. It must have been scammer's paradise.

I just didn't expect such a thing to occur today.

Man Stole $122M from Facebook and Google by Impersonating Quanta

Related Stories