In logistics and transport, the identity you trust is often not your own: a carrier's account on your portal, a broker's login on a load board, a partner's EDI certificate or a driver's shared handheld decides who collects the freight and who gets paid. Freight fraud now works mainly by stealing or faking these identities, and attackers increasingly go after the accounts and platforms that carriers and brokers use to find and book real loads. This guide covers the identity populations specific to freight forwarders, carriers, brokers, third-party logistics providers, warehouses, parcel operators and transport infrastructure operators: office and operations staff, frontline drivers and warehouse workers, external carriers and shippers, EDI and API partners, and the machine identities in fleets and warehouses. It is written for IAM, security and operations technology teams. For the sector's wider programme see the Cybersecurity for Logistics and Shipping Guide; this page goes deeper on identity only.
Key takeaways
- Partner identity is the fraud surface. Carrier onboarding, load board accounts and bank detail changes are identity events; verify the business and the person, and re-verify on every change to payment or contact details.
- Remote access tools are a cargo theft route. Criminals have used compromised load boards to lure carriers into installing remote monitoring and management software, then searched for payment, fuel card and load board access to prepare cargo theft.
- Frontline identity needs its own design. Drivers and warehouse staff work on shared scanners and in-cab devices; give them individual, fast sign-in and remove leavers from HR data, not memory.
- EDI and API credentials are long-lived machine identities. AS2 certificates, SFTP keys and API keys for every partner need an owner, an expiry and a rotation plan.
- Regulation now names identity controls. The US Coast Guard's marine transportation rule lists MFA, least privilege and credential removal for leavers, and NIS2 brings transport operators in the EU into scope for access control and MFA.
The logistics identity landscape
A logistics business connects more external organisations per transaction than almost any other sector: shipper, forwarder, broker, carrier, driver, warehouse, customs broker and consignee may all touch one shipment. Each brings identities into your systems.
| Population | Typical systems | Main identity threat | Priority control |
|---|---|---|---|
| Office, operations and dispatch staff | TMS, WMS, ERP, email, freight payment, load boards | Phishing, help desk impersonation, malicious remote access tools (T1219) | Phishing-resistant MFA, application allow-listing, help desk verification |
| Drivers and warehouse workers | Handheld scanners, in-cab tablets, driver apps, yard and gate systems | Shared logins, high turnover, agency staff who keep access | Individual sign-in on shared devices, HR-driven leavers |
| Carriers, brokers and owner-operators | Carrier portals, tendering, load boards, payment portals | Account takeover and identity theft of legitimate carriers, double brokering | Business and person verification, step-up on bank detail changes |
| Shippers and customers | Booking and tracking portals, customer APIs | Credential stuffing, fake booking accounts | CIAM with MFA, per-customer API credentials |
| EDI and API partners | AS2, SFTP, VAN, REST APIs to carriers, marketplaces and customs | Shared or never-rotated credentials, expired certificates | Per-partner credentials, certificate lifecycle management |
| Machines and devices | Telematics units, warehouse robots, scanners, gate cameras, integration service accounts | Default passwords, embedded keys, over-privileged service accounts | Per-device identity, secrets management, owner per service account |
Carrier and broker identity: stopping freight fraud
Freight fraud is an identity problem. The common patterns are a fraudster registering as a carrier using a real carrier's identifiers, taking over a legitimate carrier's or broker's account on a load board or portal, or re-brokering a load they never intend to move (double brokering). In each case the shipper or broker believes it is dealing with a verified business and releases freight or payment to someone else.
- Verify the business, then the person: check registration and authority records, insurance and the contact details on the official record, then confirm that the person onboarding is authorised by that business through a call-back to a number from the official record, not the one on the email.
- Treat bank detail and contact changes as high-risk events: require step-up authentication in the portal plus an out-of-band call-back before changing remittance details, and hold the first payment to new details for review. See the Invoice Redirection and Supplier Bank Detail Fraud Guide.
- Bind dispatch to the verified identity: confirm the driver and truck at pickup against what the carrier declared (driver name, tractor and trailer numbers), and record any late change of driver or equipment as an exception.
- Protect your own portal accounts: require MFA for carrier and broker users on your portals, and alert on new devices, new countries and email changes on carrier accounts.
- Watch the load boards: if your company's identity is used to post or book loads you did not create, that is a takeover or impersonation signal; agree a reporting route with the boards you use.
Remote access tools and cargo theft
Proofpoint has reported, from November 2025, criminals using compromised load boards to reach trucking companies for freight diversion and cargo theft. In an April 2026 write-up of one intrusion into a decoy carrier environment, the actor posted fraudulent loads on a compromised load board, emailed the carriers who responded with a script disguised as a broker-carrier agreement, and installed ScreenConnect, followed by further ScreenConnect instances, Pulseway and SimpleHelp for redundant remote access. The actor then went through the browser to a payment service and ran scripts that collected browser history and looked for banking, fuel card, fleet payment, load board and accounting services, which Proofpoint assessed as likely preparation for cargo theft. The identity lessons are specific: dispatch and broker staff should not be able to install remote access software (Remote Access Tools, T1219), unexpected attachments claiming to be rate confirmations or carrier agreements should be blocked or opened in a protected viewer, and load board, fuel card and freight payment accounts need phishing-resistant MFA and short sessions, because the attacker will be working from the victim's own browser. See the MITRE ATT&CK T1219 Remote Access Tools page and the RMM Tool Security Guide.
Frontline drivers and warehouse workers
Drivers and warehouse staff are often agency or seasonal workers, rarely have a corporate mailbox and share devices across shifts. The usual failures are one login per depot, a scanner PIN everyone knows and leavers who keep driver app access.
- Shared device sign-in: use a shared device mode on managed scanners and tablets so each worker signs in once per shift and is signed out of all apps at the end. See the Passwordless for Frontline and Shared Devices Guide.
- Badge plus PIN: a badge tap with a short PIN gives each worker an individual identity at gates, docks and scanners without slowing a dock door.
- Agency workers: feed agency starters and leavers into the same lifecycle as staff, with an end date on every account. See the Contractor Identity Lifecycle Guide.
- Driver apps: drivers use proof of delivery and messaging apps on company or personal phones; tie each app session to an individual driver, not a vehicle, so a former driver cannot keep receiving loads and addresses.
- Supervisor overrides: inventory adjustments, released holds and changed delivery addresses should record the individual who approved them, which is also the main insider fraud control.
EDI, API and partner integrations
Logistics runs on electronic data interchange: bookings, shipment status, advance ship notices, invoices and customs filings move as EDI messages over AS2, SFTP or value-added networks, and increasingly as REST APIs. Each connection is a machine identity held by two organisations.
| Integration identity | What goes wrong | Control |
|---|---|---|
| AS2 signing and encryption certificates | Expire unnoticed and stop message flow; old certificates never revoked | Certificate inventory with expiry alerts, planned exchange with each partner, revoke on change |
| SFTP accounts and keys | One account shared by several partners, passwords in scripts | One account and key pair per partner, key-only authentication, source address limits |
| Partner API keys | Full-scope keys, never rotated, held in partner code repositories | Per-partner scoped keys or OAuth client credentials, rotation dates, rate limits |
| Marketplace and carrier platform tokens | Tokens with write access to orders and payouts left with former staff | Named service accounts with owners, quarterly review |
| Integration service accounts | Domain admin or ERP superuser rights to "make the interface work" | Least privilege, interactive logon denied, credentials in a vault |
See the Service Account Security Guide and the API Key Management Guide.
Fleets, telematics and warehouse automation
Telematics units, electronic logging devices, refrigeration monitors, autonomous mobile robots and gate cameras all authenticate to cloud platforms. If they share one key per model or fleet, one extracted key exposes them all.
- Per-device identity: require unique device certificates or keys provisioned at manufacture or enrolment, never a fleet-wide shared secret. See the Device and IoT Identity Guide.
- Platform accounts: fleet platform admin accounts can locate every vehicle and, on some platforms, send commands; put them behind phishing-resistant MFA and limit who can create API keys. See the Connected Fleet and Telematics Security Guide.
- Warehouse control systems: robot fleet managers and conveyor control systems are operational technology; vendor remote access should go through a brokered, recorded session with named accounts. See the OT Remote Access Guide.
Regulation that names identity controls
| Regime | Who it covers | Identity requirements |
|---|---|---|
| US Coast Guard, Cybersecurity in the Marine Transportation System (33 CFR part 101, subpart F) | US-flagged vessels, facilities and outer continental shelf facilities regulated under MTSA | Section 101.650(a) account security: lockout after repeated failed logins, change default passwords, minimum password strength, MFA on IT systems and remotely accessible OT, least privilege for privileged accounts, separate user credentials on critical systems, remove credentials when users leave |
| EU NIS2 Directive (EU) 2022/2555 | Transport entities in air, rail, water and road (Annex I), postal and courier services (Annex II), above the size thresholds | Article 21 risk management measures include human resources security, access control policies and asset management, and the use of multi-factor authentication or continuous authentication solutions |
The Coast Guard rule took effect on 16 July 2025, with training due about six months later and the cybersecurity assessment and plan due within 24 months; check the Coast Guard for any later changes to the phase-in. See the US Coast Guard Maritime Cybersecurity Rule Guide and the NIS2 Directive Guide. Ports and vessels have their own access patterns (crew, terminal OT, port community systems); see the Maritime Vessel and Port Access Guide.
The sector's best known identity lesson came from transport infrastructure: in the Colonial Pipeline ransomware attack, one unused VPN account was enough for attackers to force the shutdown of a major US fuel pipeline. Inactive remote access accounts are the first thing to remove.
How to implement
The steps below are NHI Mgmt Group recommendations.
- Inventory (weeks 1 to 4): list every external population (carriers, brokers, agencies, partners) and the systems they reach, every EDI and API connection with its credential type and expiry, every remote access path and every device platform admin.
- Close remote access gaps (weeks 2 to 6): disable unused VPN and remote desktop accounts, require MFA on all remote access, and block unapproved remote access tools on dispatch and finance machines. Test the block list in audit mode on one depot first.
- Payment and onboarding controls (weeks 4 to 8): write the carrier verification and bank change procedure, add step-up and call-back to the portal, and apply it to your outsourced back office.
- Phishing-resistant MFA (months 2 to 4): start with load board, freight payment, TMS admin and fleet platform admins, then extend to all office staff. Keep the previous method in a pilot ring so rollback is a policy change.
- Partner credentials (months 2 to 6): separate shared SFTP and API credentials per partner, move them into a vault, and load certificate expiry dates into monitoring. Rotate one partner at a time with a scheduled test window.
- Frontline rollout (months 3 to 9): pilot shared device sign-in at one warehouse and one depot, measure shift start time, then roll out outside peak season.
- Review and exercise (ongoing): quarterly review of partner and service accounts, unannounced help desk tests, and a tabletop on a hijacked carrier account diverting a high-value load.
Decision guidance
- Federate large partners or issue portal accounts: federate shippers and 3PLs that run a mature identity provider; give small carriers and owner-operators portal accounts with your MFA policy and verified contact records.
- Badge, passkey or PIN for frontline: badge plus PIN suits docks and gates where speed matters; passkeys on managed handhelds suit supervisors and anyone who can change inventory or delivery details.
- Certificates or API keys for partners: mutual TLS or AS2 certificates suit high-volume, long-term partners; scoped OAuth client credentials suit modern APIs; avoid static shared passwords for either.
- Small operator or large group: a small carrier or broker should focus on MFA for email, load boards and payment portals, blocking unapproved remote access tools and call-back on bank changes; a group operator with warehouses and fleets needs IGA for agency workers, PAM for OT and certificate lifecycle management.
Detection and measurement
- Log: carrier account creation and contact or bank detail changes, sign-ins to load boards and payment portals from new devices, installation and execution of remote access tools, new MFA registrations (Device Registration, T1098.005), EDI certificate and SFTP key changes, and device platform API key creation.
- Correlate: a bank detail change shortly after a new device sign-in; a remote access tool running on a dispatch machine followed by load board activity; a partner credential used from a new network; a driver app session for a leaver.
| Metric | Target direction |
|---|---|
| Bank detail changes verified by out-of-band call-back | 100% |
| Load board, freight payment and TMS admin accounts on phishing-resistant MFA | 100% |
| Partner connections with their own credential and a recorded owner | 100% |
| EDI certificates expiring within 30 days without a scheduled exchange | Zero |
| Agency and seasonal accounts disabled within 24 hours of end date | Above 98% |
| Unapproved remote access tools detected on office endpoints | Falling to zero |
Framework mapping
| Area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ATT&CK and other |
|---|---|---|---|
| Carrier and broker verification | PR.AA-02 | IA-8 | T1657 Financial Theft |
| Staff and portal authentication | PR.AA-03 | IA-2, IA-2(1), AC-17 | T1566.002, T1621; 33 CFR 101.650(a) |
| Remote access tools | PR.AA-05 | AC-17, AC-6 | T1219, T1133 |
| Partner and EDI credentials | PR.AA-01, GV.SC-05 | IA-5, IA-9, SA-9 | T1199, T1552.001 |
| Frontline and agency lifecycle | PR.AA-01, PR.AA-05 | AC-2, AC-2(3) | T1078; NIS2 Article 21 |
| Monitoring | DE.CM-03 | AU-6 | T1098.005 |
Common failure patterns
- Trusting the email signature: onboarding a carrier or changing remittance details using contact details supplied in the same email thread the attacker controls.
- Unused remote access accounts: VPN or remote desktop accounts for former staff or vendors left active without MFA, the pattern behind the Colonial Pipeline attack.
- Remote access software on dispatch desks: staff able to install any remote monitoring tool from a link, which turns a phishing email into account takeover on the victim's own machine.
- One SFTP account for all partners: shared integration credentials that cannot be rotated without breaking every partner at once, so they never are.
- Depot-wide logins: one scanner or driver app login per site, which makes leavers impossible to remove and theft impossible to attribute.
- Fleet-wide device keys: telematics or robot fleets sharing one secret, so a single extracted device exposes the platform.
Practitioner checklist
- Verify every new carrier and broker against official records and a call-back to the recorded number.
- Require step-up and out-of-band confirmation for any bank detail or contact change.
- Put load board, freight payment, TMS admin and fleet platform admin accounts on phishing-resistant MFA.
- Block unapproved remote access tools on office and dispatch endpoints and alert on new ones.
- Disable unused VPN and remote desktop accounts and require MFA on all remote access.
- Give every EDI and API partner its own credential, owner and expiry date, held in a vault.
- Monitor AS2 and TLS certificate expiry and plan exchanges with each partner.
- Give drivers and warehouse workers individual sign-in on shared devices and drive leavers from HR and agency data.
- Require per-device identity in telematics and warehouse automation procurement.
- Map your obligations under the Coast Guard rule or NIS2 where they apply and evidence the identity measures.
Standards and references
- US Coast Guard (Federal Register): Cybersecurity in the Marine Transportation System final rule
- EUR-Lex: Directive (EU) 2022/2555 (NIS2)
- Proofpoint: Beyond the Breach, Inside Cargo Theft Actors Post-Compromise Playbook
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: Remote Access Tools (T1219)
Related NHI Mgmt Group resources: Cybersecurity for Logistics and Shipping Guide · Connected Fleet and Telematics Security Guide · Third-Party Access Guide · Invoice Redirection and Supplier Bank Detail Fraud Guide · Passwordless for Frontline and Shared Devices Guide