You may think that only the naive fall for phishing email scams, but even the biggest tech giants can be tricked into handing over cash. Back in March, it was reported that a Lithuanian man had swindled $100 million out of two unnamed US firms. Now, Fortune has revealed the victims were Google and Facebook.

The justice department announced the arrest of 48-year-old Evaldas Rimasauskas last month. He was charged with wire fraud, money laundering, and aggravated identity theft. Rimasauskas allegedly used forged email addresses, invoices, and corporate stamps in order to impersonate Taiwanese electronics manufacturer Quanta Computer, which counts Amazon and Apple among its clients.

"Fraudulent phishing emails were sent to employees and agents of the victim companies, which regularly conducted multimillion-dollar transactions with [the Taiwanese] company," wrote the DoJ.

Both Facebook and Google have now admitted that they were tricked by Rimasauskas’s scheme, which took place over a two-year span between 2013 and 2015. By the time the companies wised up to what was going on, he’d stashed the money in banks across Europe.

Facebook said in a statement: “We recovered the bulk of the funds shortly after the incident and have been cooperating with law enforcement in its investigation.”

Google said it had “detected this fraud against our vendor management team and promptly alerted the authorities.” The search giant also confirmed it had recouped its lost funds.

Rimasauskas continues to deny any involvement in the scheme and is currently battling against extradition to the US. If convicted, he could face decades behind bars.