A fraudster managed to steal millions of dollars from Facebook through an invoice scam involving a fake domain name and a simple invoice alteration, getting a Facebook representative to reroute payments intended for an airline's real bank account into accounts controlled by the thief.