Vendor Fraud

Fictitious-vendor billing has been the costliest asset-misappropriation type in every ACFE study since 1996; the landmark outside case is Evaldas Rimasauskas's $122 million against Google and Facebook, run from Lithuania in 2013-2015.

Billing schemes using fictitious suppliers are the most costly category of asset misappropriation in the ACFE's studies since the 1990s. An employee with purchasing or accounts-payable access creates a shell vendor and approves its invoices, or takes kickbacks from a real vendor for inflated contracts. The same mechanism used from outside - a criminal posing as a supplier to divert payments - became famous when Lithuanian Evaldas Rimasauskas billed Google and Facebook $122 million for hardware never ordered (2013-2015). Defence contracting and big-tech vendor systems have produced the largest recent cases.

Inside version: an employee registers a shell company in the vendor master file, submits invoices for goods or services never delivered and approves them, or steers contracts to a real supplier in exchange for kickbacks and inflated bills. Outside version: a fraudster registers a company with a name mimicking a real supplier, forges contracts and invoices and persuades accounts payable to pay. Fake invoices are kept below approval thresholds and spread across many periods; proceeds go to the employee's or accomplice's account.

An insider needs only vendor-master and invoice-approval access, and a shell company costs a few hundred dollars; the fraud can run for years below approval thresholds. The ACFE puts the average occupational fraud loss at $1.7 million and finds billing schemes among the most common, yet most are settled internally and never reach court.

No body publishes a vendor-fraud total; the ACFE reports a $1.7 million average loss per occupational fraud case across 1,921 cases in 2024. The largest single case is Rimasauskas's $122 million. Companies often absorb the loss silently, and honest suppliers lose contracts to kickback-paying rivals.