khoji parkScam · Lithuania, Latvia and the United States · 2019
The Invoice That Wasn’t Theirs
Two major companies paid convincing requests. The intended supplier never controlled those accounts.
Read in slides1. The familiar-looking request
Between roughly 2013 and 2015, two large American Internet businesses were drawn into an email fraud. The requests appeared connected with a hardware supplier they actually used. Money owed for legitimate business was directed to bank accounts controlled by Lithuanian citizen Evaldas Rimasauskas instead.
The business relationship was real. The payment destination was the trap.
2. An appearance of routine
An invoice usually arrives as part of an ordinary business process. Its familiar shape can encourage someone to focus on completing the payment rather than questioning the sender. The fraud exploited that expectation, presenting a demand for money as if the relationship behind it had already been established.
The unusual payment had dressed for an ordinary workday.
3. A borrowed identity
A company registered in Latvia used the same name as the genuine Asian hardware manufacturer. Messages impersonated people associated with the supplier. The deception worked around familiar business routines: employees were being asked to pay what looked like ordinary obligations, rather than offered an obviously fantastical prize.
The suspicious request had arrived dressed as routine work.
4. Paperwork behind the money
The scheme also involved forged invoices, contracts and letters. False documents were supplied to banks to support transfers. An appearance of normal commercial activity helped disguise where the money was going. The documentation was not a record of a legitimate deal; it was another part of the deception.
More paperwork did not make the underlying story more truthful.
5. The trail crosses borders
Funds moved through accounts in several countries. Lithuanian authorities arrested Rimasauskas in 2017, and he was extradited to the United States. Tracking the scheme involved international cooperation. The transfers had crossed borders quickly; the investigation would have to follow evidence across them too.
Distance complicated the case. It did not make the payments disappear.
6. Follow the transaction
Once money had moved, the investigation had to examine the transfer as well as the message that requested it. A persuasive email could not erase the accounts and records involved. The case connected an act that looked routine at a desk with a wider pattern of deliberate deception.
The money had left a more durable message.
7. An expensive routine
Rimasauskas pleaded guilty to wire fraud in March 2019 and received a five-year prison sentence that December. The sentencing announcement described losses exceeding $120 million. The case showed how a transaction can look familiar while its crucial instruction is false. The memorable failure was misplaced trust in a convincing business identity.
The request looked ordinary. The total was anything but.