Google and Facebook have confirmed that they fell victim to an alleged $ 100m ( £77m ) scam . In March , it was reported that a Lithuanian man had been charged over an email phishing attack Attack.Phishing against `` two US-based internet companies '' that were not named at the time . They had allegedly been tricked Attack.Phishing into wiring more than $ 100m to the alleged scammer 's bank accounts . On 27 April , Fortune reported that the two victims were Facebook and Google . The man accused of being behind the scam , Evaldas Rimasauskas , 48 , allegedly posed as Attack.Phishing an Asia-based manufacturer and deceived Attack.Phishing the companies from at least 2013 until 2015 . `` Fraudulent phishing emails were sent Attack.Phishing to employees and agents of the victim companies , which regularly conducted multimillion-dollar transactions with [ the Asian ] company , '' the US Department of Justice ( DOJ ) said in March . These emails purported to be from Attack.Phishing employees of the Asia-based firm , the DOJ alleged , and were sent from Attack.Phishing email accounts designed to look like Attack.Phishing they had come from Attack.Phishing the company , but in fact had not . The DOJ also accused Mr Rimasauskas of forging Attack.Phishing invoices , contracts and letters `` that falsely appeared Attack.Phishing to have been executed and signed by executives and agents of the victim companies '' . `` We detected this fraud against our vendor management team and promptly alerted the authorities , '' a spokeswoman for Google said in a statement . `` We recouped the funds and we 're pleased this matter is resolved . '' However , the firm did not reveal how much money it had transferred and recouped . Nor did Facebook - but a spokeswoman said : `` Facebook recovered the bulk of the funds shortly after the incident and has been cooperating with law enforcement in its investigation . ''

Following the news that a Lithuanian man had been charged over an email phishing scam attack Attack.Phishing against `` two US-based internet companies '' whose identities were not disclosed , it has been recently confirmed that the two companies involved were actually tech giants Google and Facebook . In a report published April 27 , Fortune disclosed the identities of both companies . The companies had been tricked Attack.Phishing into wiring over US $ 100 million to the alleged scammer ’ s bank accounts . Evaldas Rimasauskas , 48 , purportedly posed as Attack.Phishing an Asia-based manufacturer and deceived Attack.Phishing the two companies from at least 2013 to 2015 . `` Fraudulent phishing emails were sent to Attack.Phishing employees and agents of the victim companies , which regularly conducted multimillion-dollar transactions with [ the Asian ] company , '' the US Department of Justice ( DOJ ) said . The DOJ alleged that emails supposedly from the employees of said Asian manufacturer were sent from Attack.Phishing email accounts designed to look like Attack.Phishing they were actually from the firm . Rimasauskas was charged by the DOJ in March of sending Attack.Phishing the forged emails , as well as for fabricating invoices , contracts and letters `` that falsely appeared Attack.Phishing to have been executed and signed by executives and agents of the victim companies . '' `` We detected this fraud against our vendor management team and promptly alerted the authorities , '' a spokesperson for Google said in a statement . `` We recouped the funds and we 're pleased this matter is resolved . '' `` Facebook recovered the bulk of the funds shortly after the incident and has been cooperating with law enforcement in its investigation , '' a representative from Facebook said . The BBC reported that neither Google nor Facebook revealed how much money they had transferred , or how much they recouped following the incident . While the two companies have advanced cybersecurity measures in place , the phishing attacks Attack.Phishing targeted individuals through their emails — attacks that could have been avoided through proper verification of dubious payment requests . `` Sometimes staff [ at large firms ] think that they are defended , that security is n't part of their job , '' James Maude of cyber-security firm Avecto told the BBC . `` But people are part of the best security you can have — that 's why you have to train them . ''