[jjeaff]

My guess is that it's the small to mid-sized businesses that end up being the easiest targets. Many don't have all the same record keeping or auditing practices. I've read about scammers just sending random invoices to small businesses and getting paid. Someone did this to the tube of millions to the likes of Facebook and Google, but I guess were eventually found out.

[fbdab103]

A report [0] on the Google/Facebook invoices. Such a simple idea, if they had stuck to a few $500k requests and stopped, they likely never would have been caught. As I recall (not in the linked story), one of the reasons one of the expenses was flagged was because the scammers invoiced a higher amount ($10million+) requiring additional approvals.

[0] https://www.npr.org/2019/03/25/706715377/man-pleads-guilty-t...

Edit: Fixed typo