A Lithuanian Phisher Tricked Two Big US Tech Companies Into Wiring Him $100 Million (theverge.com)

According to a recent indictment from the U.S. Department of Justice, a 48-year-old Lithuanian scammer named Evaldas Rimasauskas managed to trick two American technology companies into wiring him $100 million. He was able to perform this feat "by masquerading as a prominent Asian hardware manufacturer," reports The Verge, citing court documents, "and tricking employees into depositing tens of millions of dollars into bank accounts in Latvia, Cyprus, and numerous other countries." From the report: What makes this remarkable is not Rimasauskas' particular phishing scam, which sounds rather standard in the grand scheme of wire fraud and cybersecurity exploits. Rather, it's the amount of money he managed to score and the industry from which he stole it. The indictment specifically describes the companies in vague terms. The first company is "multinational technology company, specializing in internet-related services and products, with headquarters in the United States," the documents read. The second company is a "multinational corporation providing online social media and networking services." Both apparently worked with the same "Asia-based manufacturer of computer hardware," a supplier that the documents indicate was founded some time in the late '80s. What's more important is that representatives at both companies with the power to wire vast sums of money were still tricked by fraudulent email accounts. Rimasauskas even went so far as to create fake contracts on forged company letterhead, fake bank invoices, and various other official-looking documents to convince employees of the two companies to send him money. Rimasauskas has been charged with one count of wire fraud, three counts of money laundering, and aggravated identity theft. In other words, he faces serious prison time of convicted -- each charge of wire fraud and laundering carries a max sentence of 20 years. The court documents don't reveal the names of the two companies. Though, one could surely think of a few candidates that would fit the descriptions provided in the court documents.

Comments

Re:Slashdot Hacked! - CONFIRMED

[lucm]

You mean there's more than one? I thought it was just one guy with no life and a lot of conflicting opinions.

Umm, what?

[Anonymous Coward]

The indictment specifically describes the companies in vague terms.

Specific and vague simultaneously?

Interesting how few controls there are

[ErichTheRed]

I've worked for big companies most of my career, and regular employees making purchases, signing contracts, etc. takes an act of God. I can't spend $100 on supplies without getting competitive bids. But there are apparently some very stupid people who have full unrestricted access to the bank accounts.

How do people fall for phishing scams anymore? Everyone has to know this by now -- never trust email requesting you to do anything involving linking to a website, sending money, etc. This could have all been resolved by someone calling and asking if they should really pay this $8 million "invoice" with an irreversible wire transfer.

It reminds me of how people were talking about the Podesta email incident as some massively complex hacking job. It wasn't -- they found out he still used Yahoo Mail and phished him. I can't believe that (a) one of the most powerful political operatives in the Clinton campaign uses Yahoo Mail, and (b) that he fell for it.

Re:Interesting how few controls there are

[PhunkySchtuff]

I've worked for big companies most of my career, and regular employees making purchases, signing contracts, etc. takes an act of God. I can't spend $100 on supplies without getting competitive bids.

See, that's where you're going wrong. I've actually had clients tell me that a proposal has to be _over_ a certain dollar amount - if it's less than (for example) $50k, it's subject to a lot more oversight than, say, $1M. Small, petty cash type purchases are even more difficult, relatively speaking. Good luck trying to get approval for a new mouse for your workstation!

Re:Interesting how few controls there are

[Calydor]

- Especially once they start breeding.

Re: Google & Facebook

[quenda]

there was one guy who managed to make Soviet central bank to wire close to usd $500m to his personal account

I imagine he had a very impressive funeral.

Re:Sentences

[Kiuas]

You can kill 10 people and go to Jail, rape and kill in there too, and still get a sentence that's a fraction of the above with ability for parole. But trick an idiot company and take their money and you suddenly face up to 80 years jailtime?!

And yet, if instead of scamming some 100 million from a couple of companies the guy had been working for an investment bank or a credit rating agency and created purposefully misleading derivatives to help crash the global economy to the tune of billions in damages, he'd have gotten no jail time at all. Not a single bank executive has seen jailtime for causing the 2008 crisis, even though the extent of damages makes scams like this seem like pickpocketing and it's quite clear that the banks knew exactly what they were doing.when they started creating collateralized debt obligations from the subprime loans to circumvent the credit rating system. Quoting the wiki:

According to the Financial Crisis Inquiry Report, "the CDO became the engine that powered the mortgage supply chain",[7] promoting an increase in demand for mortgage-backed securities without which lenders would have "had less reason to push so hard to make" non-prime loans.[8] CDOs not only bought crucial tranches of subprime mortgage-backed securities, they provided cash for the initial funding of the securities.[7] Between 2003 and 2007, Wall Street issued almost $700 billion in CDOs that included mortgage-backed securities as collateral.[7] Despite this loss of diversification, CDO tranches were given the same proportion of high ratings by rating agencies[30] on the grounds that mortgages were diversified by region and so "uncorrelated"[31]—though those ratings were lowered after mortgage holders began to default.[32][33]

The rise of "ratings arbitrage"—i.e. pooling low-rated tranches to make CDOs—helped push sales of CDOs to about $500 billion in 2006,[14] with a global CDO market of over USD $1.5 trillion.[34] CDO was the fastest-growing sector of the structured finance market between 2003 and 2006; the number of CDO tranches issued in 2006 (9,278) was almost twice the number of tranches issued in 2005 (4,706)

(emphasis mine)

What it basically means is that if you tried creating a CDO using subprime loans from a single region it would have been rated badly (as it should, it's an extremely high risk product as many of the loans had been granted pretty much without any checks on the ability of the lender to pay for them), but if you take equally shitty loans from several different areas the credit rating agencies put a AAA stamp on it, because according to their logic at the time this means the default risk is now diversified, which is complete bullshit.

This should showcase the real issue with these cases: the courts - especially in the US but also elsewhere in the West - are keen to protect the interests of corporations. Embezzlement/fraud of corporate funds will lead to heavy jail time when caught. That's why Maddof is in jail: he scammed rich folks and corporations. However at the same time the courts go so far to protect corporate interests that megacorporations themselves can pretty much act with inpunity - cause a massive oilspill or an economic meltdown and you'll get fined, and you can write that down as yet another operational cost and keep doing business as usual.

I do not have a problem with large scale financial crime being punished heavily, because it has far reaching consequences and fines don't work against people and corporations with massive fortunes. However, the laws should be applied evenly to everyone, including the financial sector itself when it fucks up. Right now the US is basically letting WS do whatever it pleases and if shit hits the fan the costs are externalized to the taxpayer. And the City of London is no better,