Google and Facebook have confirmed that they fell victim to an alleged $100m (£77m) scam.
In March, it was reported that a Lithuanian man had been charged over an email phishing attack against "two US-based internet companies" who were not named at the time.
On 27 April, Fortune reported that the two victims were Facebook and Google.
However, the firm did not reveal how much money it had transferred and recouped.
Big firms targeted
"Sometimes staff [at large firms] think that they are defended, that security isn't part of their job," said James Maude at cyber-security firm Avecto, commenting on the phishing threat facing big companies.
He also told the BBC that Avecto's clients have recounted phishing attempts that used senior staff's hacked email accounts to convince employees that a request to wire out money was genuine.