Facebook catches a lot of criticism for not doing enough to protect its users. However, a recent criminal case shows that the tech giant might not always be great at safeguarding itself, either, as it recently admitted to falling for a $100 million scam.

The massive scheme was allegedly orchestrated by a Lithuanian man, Evaldas Rimasauskas, who forged emails, invoices and stamps posing as a Taiwanese manufacturer that does business with many major U.S. tech companies. Using the forged documents, officials say he was able to trick Facebook and Google into paying him tens of millions of dollars.

Facebook said it caught on to the scheme quickly and recovered the bulk of its funds, but a U.S. attorney involved in the case said tech companies should take the case as a warning.

“This case should serve as a wake-up call to all companies — even the most sophisticated — that they too can be victims of phishing attacks by cyber criminals,” acting U.S. attorney Joon H. Kim said.

Of course, Facebook likes to pride itself on being a state-of-the-art tech company capable of defending its users from all kinds of cybercrime and malware. However, it’s easy to lose faith in the site’s efforts when it falls prey to such an elaborate and enormous scam itself.