Freight Fraud and Cargo Theft: Stopping Fictitious Pickups and Double Brokering

A growing share of cargo theft is not a break-in at the yard but deception: a load handed to a truck that the shipper believed belonged to a vetted carrier. Fictitious pickups, double brokering and carrier identity theft turn a booking process built on email, phone calls and public registration numbers into a theft route. This guide covers how these schemes work at the level a defender needs, the verification controls that stop them at tender, dispatch and the dock door, how to detect them early, and what to do when a load goes missing. It is written for shippers, freight brokers, carriers, third-party logistics providers and the security and finance teams who support them. The identity side of logistics, including portal accounts and partner integrations, is covered in the Logistics and Transport Identity Security Guide; this page focuses on the fraud process itself.

Key takeaways

• Deception is now a quarter of reported incidents. Verisk CargoNet counted 138 fictitious pickups in the third quarter of 2026, about 25% of reported US and Canadian supply chain crime incidents, up from 18% a year earlier.
• A registration number is not an identity. USDOT and MC numbers, insurance certificates and company names are public and can be copied; verify the business through official records and contact details you find yourself, not those in the email.
• Release the load to a verified truck, not a name. Withhold pickup numbers until the driver, tractor and trailer at the dock match what the carrier declared.
• Treat every late change as a fraud signal. New driver, new truck, new contact, new bank details or a request to re-route in transit all need an out-of-band call-back before you act.
• Your own email and load board accounts are part of the attack surface. Compromised business email, phone systems and transport applications let criminals impersonate legitimate firms, so protect them as you would payment systems.

How the main schemes work

The schemes overlap, and organised groups combine them. TT Club, the transport and logistics insurer, describes three ways a fake carrier may present itself: an entirely fictitious company, a fraudster taking on the identity of a legitimate company, and a legitimate company operating with intent to defraud.

Verisk CargoNet's third quarter 2026 report notes that earlier in 2026 it documented schemes using compromised business email accounts, internet-based phone systems and transportation industry applications to impersonate legitimate companies, obtain shipment details or redirect freight already in transit. Its 2026 figures show fewer incidents but higher losses: estimated losses of $718.9 million year to date through September, up 39%, with the average documented theft value rising about 72% to $448,456. CargoNet notes that recent figures may be revised as late reports arrive.

Verifying carriers before you tender

Onboarding is where most identity theft can be caught, because the fraudster has to supply contact and payment details that differ from the real business's.

Check the business against official records

• Registration and authority status (US): look up the carrier on FMCSA's official SAFER Company Snapshot (safer.fmcsa.dot.gov) and confirm operating authority is active. Type the address yourself: FMCSA's fraud alerts list lookalike SAFER and portal domains used in phishing.
• Registration changes: FMCSA's Motus registration system launched in May 2026, and FMCSA requires new registrants to pass identity proofing and verification, using IDEMIA for document capture and verification. These checks cover new registrants; they do not tell you whether the person on the phone represents the registered business.
• Numbers cannot be sold: FMCSA states that USDOT numbers cannot be sold, transferred, rented or leased, and that it will inactivate numbers used by anyone other than the assigned legal entity. An offer to "use our authority" is a red flag.
• Insurance confirmed with the insurer: TT Club advises verifying the policy directly with the insurer, not through the documents or contacts provided, and requesting originals of electronically submitted certificates.
• Outside the US: use the equivalent operator licensing register and company registry for the jurisdiction, and the vetting guidance of the freight exchanges you use.

Then verify the person

1. Call the carrier on a phone number taken from the official record or from your own past dealings, not from the email or rate confirmation.
2. Ask that the person onboarding confirm a detail only the real business would know, such as a recent load reference with you.
3. Compare email domains, phone numbers and remittance details with the official record and with previous loads. Free email addresses and mobile-only contact were flagged by TT Club as warning signs.
4. Apply extra scrutiny to newly issued authority, frequent changes of name, ownership or insurer, and authority that has been dormant and suddenly becomes active.
5. Record who verified the carrier, how and when, so the check can be audited.

For the general approach to proofing a business counterparty, see the Identity Proofing and KYC Guide and the Third-Party Access Guide.

Controls at dispatch and the dock door

Even a well-vetted carrier can be impersonated at pickup. The control objective is to bind the physical collection to the verified booking.

Dock staff often face pressure to release quickly. TT Club's guidance is direct: do not be pressured into circumventing due diligence procedures. Give dock and dispatch staff a clear escalation route and the authority to refuse a release.

Preventing double brokering

• Contract terms: rate confirmations and broker-carrier agreements should prohibit re-brokering, co-brokering or subcontracting without written consent, and say what happens to payment if it occurs.
• Confirm the hauler: the carrier at the dock must be the carrier you tendered to. A different name on the truck, or a driver who cannot name your contact, triggers a hold.
• Watch payment disputes: a carrier you have never contracted contacting you for payment is a strong sign that the load was re-brokered.
• Offers that look too good and urgency: TT Club lists offers that look too good and time pressure among its warning signs.
• Regulatory context (US): 49 U.S.C. 14916 covers unlawful brokerage activities. FMCSA told Congress in July 2024 that since the 2019 Riojas decision it cannot assess civil penalties administratively for unauthorised brokerage and must refer cases to federal court, and asked for that authority. Do not rely on enforcement as a deterrent; rely on your own controls.

Protecting your own accounts and staff

Criminals target dispatchers, brokers and carrier offices because their accounts carry trust. Proofpoint reported in April 2026 on an intrusion that began after a load board was compromised: carriers who responded to fraudulent loads received emails linking to a malicious file disguised as a broker-carrier agreement, which installed several legitimate remote monitoring and management tools. The actor then searched for banking, fuel card, fleet payment, load board and freight brokerage services, which Proofpoint assessed as likely preparation for cargo theft and freight diversion.

• Phishing-resistant MFA on email, load boards, transport management systems, fuel card and freight payment accounts. See the MFA Guide.
• No unapproved remote access tools: block installation of remote monitoring and management software outside an approved list (ATT&CK T1219 Remote Access Tools). See the RMM Tool Security Guide.
• Attachment handling: rate confirmations and carrier agreements from new contacts open in a protected viewer; script files are blocked at the mail gateway.
• Official channels only: FMCSA states that it will not call immediately after an application, will not use telemarketers or robocalls and will not ask for a credit card number. Its fraud alerts describe emails requesting USDOT PINs, EINs and Social Security numbers through lookalike links (ATT&CK T1566.002 Spearphishing Link).
• Staff awareness: train dispatch, brokerage and dock staff on the specific schemes in this guide, using your own near misses as examples. See the Vishing and Smishing Guide.

Implementation plan

1. Month 1, baseline: map how loads are tendered, who approves new carriers, how pickup numbers are issued and how carrier bank details are changed. Collect the last 12 months of near misses and losses.
2. Month 1 to 2, onboarding standard: write a carrier verification procedure (official record check, call-back, insurance confirmation, evidence recorded). Pilot it with one brokerage desk or one site, then extend.
3. Month 2 to 3, dock release: introduce declared driver and equipment checks, withheld pickup numbers and change holds at the highest-value sites first. Measure release delays and adjust; keep a supervisor override with logged justification as the rollback path.
4. Month 2 to 4, account protection: enforce MFA on email and transport platforms, restrict remote access tools and harden mail handling for dispatch teams.
5. Month 3 to 4, contracts and payments: update rate confirmation terms on re-brokering, and route all remittance changes through finance call-back controls.
6. Ongoing: run quarterly exercises using a simulated fictitious pickup, and review every exception and near miss.

Decision guidance

• Shippers with their own docks: focus on release controls and on requiring brokers to provide declared driver and equipment details before arrival.
• Brokers: carrier onboarding and continuous monitoring are the core controls; you are the party most likely to be targeted with stolen carrier identities.
• Small carriers: protect your registration, email and load board accounts with MFA, monitor for loads booked in your name, and report impersonation quickly to the platforms and to FMCSA.
• High-value or targeted commodities: CargoNet's third quarter 2026 data shows food and beverage, metals including copper, household goods, electronics and personal care products as the most reported categories; apply stricter release rules to these loads and to peak periods.
• Manual versus automated vetting: automated carrier monitoring services scale for large brokers; small operators can achieve most of the benefit with a disciplined manual call-back and a short checklist.

Detection and measurement

• Onboarding signals: recently changed contact details on a carrier profile, mismatched email domains, new authority with immediate high-value bookings.
• Dock signals: driver or equipment mismatch, unknown carrier name on the truck, pressure to release quickly.
• Transit signals: tracking turned off, route deviation, requests to re-route.
• Account signals: new sign-in locations on load board and email accounts, mailbox forwarding rules, new remote access software on dispatch machines.

When a load goes missing

1. Contact the tendered carrier on its known number to confirm whether it holds the load.
2. Report to local police with the load details, photographs, driver and vehicle records captured at release.
3. Notify your insurer and the cargo owner as your contracts require.
4. In the US, FMCSA directs fraud and identity theft reports to the FTC (reportfraud.ftc.gov), the FBI Internet Crime Complaint Center (ic3.gov), local police or the state attorney general, and FMCSA's contact centre.
5. Preserve emails with full headers, call logs, load board messages and rate confirmations.
6. Freeze payments on the load and review any recent bank detail changes.
7. Check whether your own accounts were compromised, using the Email Identity and BEC Guide.

Framework mapping

Common failure patterns

• Trusting the paperwork: a correct USDOT number and a valid-looking insurance certificate accepted without checking the contact details against the official record.
• Calling the number in the email: the call-back reaches the fraudster, who confirms everything.
• Pickup number shared at booking: anyone who obtains the booking email can collect the load.
• Late driver swaps accepted on a text message: the most common gap at busy docks.
• Load board and email accounts without MFA: compromised accounts let criminals post loads and contact carriers as you.
• Urgency overriding policy: peak season and last-minute loads are when vetting is skipped and when fraudsters are most active.

Practitioner checklist

• Verify every new carrier against official records and by call-back to a number you sourced yourself.
• Confirm insurance directly with the insurer and request originals of certificates.
• Collect declared driver, tractor and trailer details before arrival and match them at the dock.
• Withhold pickup numbers until the driver and equipment are verified on site.
• Hold release on any late change of driver, truck or carrier until verified out of band.
• Prohibit re-brokering in rate confirmations and confirm the carrier actually hauling.
• Enforce MFA on email, load boards, transport platforms and payment accounts; block unapproved remote access tools.
• Route every remittance change through finance call-back controls.
• Keep a missing-load procedure with reporting contacts and evidence to preserve, and exercise it quarterly.

Standards and references

• FMCSA: Fraud Alerts
• FMCSA: Identity Verification
• FMCSA: Registration
• FMCSA: Unlawful Brokerage Activities Report to Congress
• Verisk CargoNet: Fewer Cargo Thefts, Bigger Losses, Q3 2026
• TT Club: Be alert to carrier fraud
• TT Club: Theft trends, carrying out effective due diligence
• Proofpoint: Inside cargo theft actors' post-compromise playbook

Related NHI Mgmt Group resources: Logistics and Transport Identity Security Guide · Cybersecurity for Logistics and Shipping Guide · Invoice Redirection and Supplier Bank Detail Fraud Guide · Email Identity and BEC Guide