The invoice looked right because the shipment was real.

Between 2013 and 2015, a man in Lithuania registered a company with the same name as Quanta Computer, a real Taiwanese manufacturer that really did supply servers to Facebook and Google. He sent invoices. Both companies paid them. By the time he was caught, the total was more than $120 million.

$3 billion a year, and rising

The FBI calls it business email compromise. Most of it is invoice fraud: a payment request that looks like it came from a real vendor, with one detail changed. The 2025 figure was up from $2.77 billion the year before.

The $121 million supplier

The Facebook and Google case is the one every security team knows, and the detail that matters is the boring one. The fraudster did not invent a supplier. He copied one. Quanta was a real vendor to both companies, with real contracts and real shipments, so the forged invoices matched relationships that accounting already recognized. Facebook wired about $99 million. Google wired about $23 million. He was sentenced to five years.

He did not need to break in. He needed to know who they bought from, and roughly when.Our reading of the Department of Justice and CyberScoop accounts of the 2019 sentencing.

It is always a real relationship

• 2014 · SCOULARAn Omaha grain trader wired $17.2 million to a Chinese bank on the strength of spoofed emails about a real, planned acquisition in China.
• 2019 · TOYOTA BOSHOKUA European subsidiary of the Toyota parts maker lost about $37 million to one fraudulent payment instruction from a party posing as a business partner.
• 2020 · PUERTO RICOA government development agency wired $2.6 million after a single email asking it to update the bank account for a real remittance.
• 2025 · BROKEN BOW SCHOOLSA rural Nebraska district paid $1.8 million to someone impersonating the contractor actually building its bond project. About $700,000 was recovered.

Read the four together and the pattern is not technical. Every one of them started with a true fact about a real business relationship, then changed the bank account.

What the fraudster needs to know

To send a convincing invoice you need the supplier's name, a real recent shipment, and roughly when it landed. No public case has named a trade-data platform as the place a fraudster found those facts, and we will not pretend one has. It does not need to have happened. For most importers, the supplier, the shipment and the arrival week are already in a public record that anyone can search by company name.

We put a federal confidentiality protection in place for every entity and name you ship under, and we keep watching the platforms after that. The invoice that looks right gets harder to write when the shipment behind it is not public.

Sources

1. FBI Internet Crime Report 2025 · FBI IC3, Apr 2026
2. Business email compromise: the $55 billion scam · FBI IC3 public service announcement, Sep 11, 2024
3. Man who scammed Facebook and Google out of $120 million sentenced · CyberScoop, Dec 20, 2019
4. Over $37 million lost by Toyota Boshoku subsidiary in BEC scam · BleepingComputer, Sep 6, 2019
5. Omaha’s Scoular Co. loses $17 million after spearphishing attack · CSO Online, Feb 2015
6. Puerto Rico government falls for $2.6 million email scam · Security Boulevard, Feb 13, 2020
7. Phishing scam cost rural Nebraska school district $1.8M · GovTech, Jul 16, 2025
8. Business email compromise used to defraud vendors · FBI IC3 public service announcement, Mar 24, 2023