Get all your news in one place.
100’s of premium titles.
One app.
Start reading
The Guardian - US
The Guardian - US
Technology
Alan Yuhas

Lithuanian man's phishing tricked US tech companies into wiring over $100m

hands computer
Evaldas Rimasauskas posed as a computer hardware manufacturer by creating his own company. Photograph: Alamy Stock Photo

Two major American tech companies were tricked by a Lithuanian man’s phishing scheme into wiring him over $100m, according to the justice department.

Evaldas Rimasauskas, 48, was arrested last week by Lithuanian authorities and charged on Monday by prosecutors in the southern district of New York. Announced on Wednesday, the charges of wire fraud, money laundering and aggravated identity theft could carry a sentence of 20 years in prison.

According to the criminal complaint, Rimasauskas posed as a computer hardware manufacturer by creating his own company, registered in Latvia, with the same name as a legitimate one in Asia.

For roughly two years, Rimasauskas “and others known and unknown” pretended to be employees or agents of the Asian company, according to the charges. They then sent phishing emails to representatives of the major tech firms, which regularly “conducted multimillion dollar transactions” with the manufacturer. The American firms followed the email instructions and wired tens of millions of dollars to bank accounts in Lithuania, Latvia, Cyprus, Slovakia, Hungary and Hong Kong.

Rimasauskas also forged letters, invoices, corporate stamps and contracts in the name of executives of his target companies, and tried to disguise the flow of money through bank accounts in the United States, according to prosecutors. His fraudulent company, authorities said, had a board of directors that consisted of one man: Rimasauskas.

“This case should serve as a wake-up call to all companies – even the most sophisticated – that they too can be victims of phishing attacks by cyber criminals,” acting US attorney Joon Kim said in a statement.

In its court documents, prosecutors did not name either the “victim companies” or the manufacturer that Rimasauskas allegedly impersonated. That company was “established in or about the late 1980s”, prosecutors said, and provides “goods and services to various technology companies around the world”.

One of the American victim companies was described as a “multinational technology company, specializing in internet-related services and products”. The second was described as “a multinational corporation providing online social media and networking services”. Both “regularly engaged in multimillion dollar transactions” with the Asian manufacturer, authorities said.

Several large American tech companies, including Google, Facebook and Twitter, did not reply to requests for comment about their possible involvement in the case.

Kim said that thanks to cooperation with the FBI, the unnamed “victim companies” and their banks, and Lithuanian law enforcement, authorities had managed to recover “much of the stolen funds”.

FBI assistant director William Sweeney Jr said Rimasauskas had carried out an “email compromise scheme creatively targeting two very specific victim companies”. But Rimasauskas left a “footprint”, Sweeney said, that “would eventually lead investigators to the truth”.

The justice department did not comment on possible extradition, but said the case had been assigned to a US district judge.

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.