Home

Case in Point: The $120 Million Invoice Scheme

Insight

October 15, 2026

At a glance

Case: United States v. Evaldas Rimasauskas (U.S. Attorney's Office, Southern District of New York)
Scheme: Business email compromise using a look-alike supplier and forged documents
Period: 2013 to 2015
Losses: More than $120 million from two U.S. companies
Outcome: Guilty plea to wire fraud; 60 months in prison; forfeiture of $49,738,559.41 and restitution of $26,479,079.24

This is a public case, summarized from the U.S. Department of Justice announcement. It is not a Gemean client matter. We share it because it shows, at scale, the pattern behind many of the business email compromise matters organizations face today.

What happened

According to the Department of Justice, between 2013 and 2015 Evaldas Rimasauskas targeted two U.S. companies: a multinational technology company and a multinational social media company. Both did regular business with a legitimate Asian computer hardware manufacturer.

Rimasauskas registered a company in Latvia with the same name as that hardware manufacturer, and opened bank accounts in Latvia and Cyprus in the name of the fake company. Employees at the victim companies then received emails that appeared to come from the real supplier, directing payment for real goods and services to the accounts he controlled.

To keep the money moving, he also caused forged invoices, contracts, and letters, made to look as if they had been signed by executives and agents of the victim companies, to be submitted to banks. The stolen funds were then moved through accounts in Latvia, Cyprus, Slovakia, Lithuania, Hungary, and Hong Kong.

In total, the two companies were defrauded of more than $120 million.

How it ended

Rimasauskas was arrested in Lithuania in March 2017 and extradited to the United States in August 2017. He pleaded guilty to wire fraud and was sentenced to five years in prison, followed by two years of supervised release. He was ordered to forfeit $49,738,559.41 and to pay $26,479,079.24 in restitution.

What the case shows

Size is not protection. Both victims were among the most sophisticated technology companies in the world. The scheme did not need to defeat their security tools. It needed a convincing supplier name, a believable payment request, and a payment process that trusted both.

The fraud is in the process, not the code. Every step relied on routine business activity: a familiar vendor, a normal invoice, a standard wire. That is why business email compromise is so hard to spot from the inside, and why verification of any change to payment details matters more than any single technical control.

The trail crosses borders quickly. Within the scheme, money moved through accounts in six countries. The sooner a fraudulent payment is reported to the bank and to law enforcement, the better the chance of tracing and freezing funds.

Documents become evidence. Forged invoices, contracts, and letters were part of the scheme, and the communications, payment records, and bank documents became the record that explained it. Preserving email, payment approvals, and vendor master data at the outset is what makes that record usable.

How Gemean helps

Gemean's digital forensics, forensic accounting, and incident response teams work together on business email compromise matters: preserving email and cloud evidence, reconstructing how the fraud was carried out, tracing the payment path, and documenting findings for banks, insurers, regulators, and courts.

If you suspect a business email compromise, or want to test how your organization would respond to one, connect with our experts at https://bit.ly/4qogx0H.