Nigerian scammers are targeting Fortune 500 companies, and have already stolen millions of dollars from some of them, IBM Security researchers have found.

Their strategy is well known: they take over or impersonate a trusted user’s email account to target companies that conduct international wire transfers, and trick accounts payable personnel into wiring money into bank accounts under their control.

These so-called business email compromise (BEC) scams don’t require much technical knowledge, malware or special tools, and each successful attack against a well-heeled individual or organization can net scammers quite a lot of money.