Published
Reported cargo thefts are down by a third from last year, but the losses keep growing. New data from Verisk CargoNet and a November guide from CargoRex show where the money is going and how the thieves are getting to it.
If you only looked at incident counts, 2026 would seem like a decent year for freight security. Verisk CargoNet logged 547 supply chain crime incidents across the U.S. and Canada in the third quarter, about a third fewer than in the same quarter of 2025.
The dollar figures say otherwise. Estimated losses for the quarter came to $230.1 million, up 12% year over year, and losses for the first nine months reached $718.9 million. That is a 39% increase over the same stretch last year and already within a few million dollars of the full-year 2025 total, which CargoNet put at nearly $725 million.
CargoRex, a freight security directory and research site, published a prevention guide in November built from that data and six practitioner interviews, most of them recorded at the IANA Intermodal EXPO in Long Beach in September. The CargoRex 2026 cargo crime research is worth reading in full. Its central point is one we keep running into with smaller carriers and brokerages: the people stealing freight have become far more selective, and the most expensive thefts now tend to begin with a fake identity or a stolen login rather than a cut lock.
The numbers so far
These figures come from different organizations that count different things, so they shouldn’t be added together. Read side by side, though, they line up.
| Figure | What it measures | Source |
|---|---|---|
| Nearly $725 million | Estimated 2025 cargo theft losses, U.S. and Canada, up 60% from 2024 | Verisk CargoNet, Jan. 2026 |
| $273,990 | Average value per theft in 2025, up 36% | Verisk CargoNet, Jan. 2026 |
| $304.6 million | Q2 2026 losses, more than double Q2 2025, on 26% fewer incidents | Verisk CargoNet, Aug. 2026 |
| $718.9 million | Estimated losses, January through September 2026, up 39% | Verisk CargoNet, Nov. 2026 |
| About 25% | Share of Q3 2026 incidents that were fictitious pickups, up from 18% | Verisk CargoNet, Nov. 2026 |
| 19 | Q3 2026 thefts valued at $1 million or more, compared with 9 a year earlier | Verisk CargoNet, Nov. 2026 |
| 73.5% | Share of cargo stolen from motor carriers that is never recovered | ATRI, Oct. 2025, via CargoRex |
| About half | Highway’s Q1 2026 fraud incidents involving direct theft by carriers with legitimate histories | Highway, via CargoRex |
All of the theft counts reflect reported incidents only. Plenty of thefts never reach a tracking network, so the real totals are higher. Vendor figures, like Highway’s, describe that company’s own network rather than the whole market.
Pickier thieves, bigger hauls
The gap between falling incidents and rising losses comes down to what is being taken. CargoNet has spent most of the year flagging metals and enterprise technology as the commodities driving its loss figures. Copper is the most common metal target, and data center hardware has shown up repeatedly in the largest thefts. In the third quarter alone, CargoNet counted 19 thefts worth at least $1 million, more than double the number from a year earlier.
Those loads often look like any other dry van shipment, which is part of the appeal. Jared Palmer, one of the people CargoRex interviewed, pointed out that copper loads worth roughly $400,000 are still being posted on public load boards, where anyone shopping for a target can see the commodity, the lane, and the pickup date.
Meanwhile, some of the cheaper and more physical forms of theft have tapered off. CargoNet reported fewer thefts of unattended trailers in the second quarter and fewer non-delivery schemes, particularly in California and Texas. The thieves did not disappear. They seem to have moved toward work that pays more per job.
Getting the freight handed over
Security people in freight draw a line between straight theft, where someone physically takes a trailer or breaks into a container, and strategic theft, where the freight is released voluntarily to someone who only looks legitimate. Fictitious pickups are the classic example. A criminal books the load under a fake or stolen carrier identity, shows up with paperwork that checks out, and drives away with it.
Scott Cornell of SPG Cargo & Logistics told CargoRex that strategic theft made up roughly 3% of cargo theft before 2020 and is closer to 30% now. That is his estimate rather than a measured figure, but it fits the trend in CargoNet’s data. Fictitious pickups dipped only slightly in raw numbers this year while everything else fell faster, so their share of reported incidents climbed to about one in four.
Once the freight leaves, it moves quickly. Palmer described stolen loads being cross-docked, relabeled, or put on a ship within 24 to 48 hours. That speed helps explain the ATRI estimate that nearly three-quarters of cargo stolen from motor carriers is never recovered.
One of the less comfortable findings in the guide comes from Highway, which reported that roughly half of the fraud incidents in its Q1 2026 index involved direct theft by carriers with legitimate operating histories. CargoNet has made a related observation, noting that many complex schemes depend on acquiring existing motor carriers that already have strong load histories. A good safety rating and years of authority describe the company. They say nothing about who is running it this month, which is why we argued in an earlier piece that valid credentials don’t settle the question for high-value loads.
The inbox has become the entry point
CargoNet has said repeatedly this year that business email compromise is the main way into the most sophisticated schemes. The FBI made a similar point in an April public service announcement on cyber-enabled cargo theft, describing spoofed brokers, compromised carrier accounts, manipulated bills of lading, and drivers who are sometimes unaware they are hauling a stolen load.
The typical sequence starts with something that looks like ordinary freight paperwork. A dispatcher gets a broker setup packet, a rate confirmation, or a notice from a load board or the FMCSA portal. The link leads to a convincing sign-in page or installs remote-access software. From there, the attacker can sit inside a real mailbox, set up forwarding rules, learn which loads and lanes matter, and wait for the right moment to book a shipment or send a new delivery address from an account the other side already trusts. We have written about several versions of this, including borrowed carrier identities, fake Motus sign-in pages, and phony Truckstop and RMIS notices.
Highway’s Q3 numbers put a figure on how common this has become in its network, tying about 40% of reported stolen loads to compromised communications. The CargoRex guide adds that organized groups are now using AI to write phishing messages that read like they came from a real dispatcher, and it cites CrowdStrike’s finding that attackers took an average of 29 minutes in 2025 to move from an initial account takeover into the rest of a network. The fastest case took 27 seconds.
For a small carrier or brokerage, that changes what the most valuable asset in the building is. A parked trailer still matters, but so does the login to the load board, the factoring portal, and whatever inbox the dispatcher uses to confirm changes.
A new kind of account to worry about
The guide spends some time on a risk most small freight businesses haven’t had to think about yet. TMS integrations, automated load matching, email assistants, and AI agents all hold their own credentials and permissions, and many of them can read shipment details or make changes on someone’s behalf.
CargoRex cites Gartner’s projection that the average Fortune 500 company will be running more than 150,000 AI agents by 2028, up from fewer than 15 in 2025, along with survey data suggesting only about 13% of organizations think they govern those agents adequately. CrowdStrike also reported finding malicious instructions planted inside generative AI tools at more than 90 organizations last year.
The scale is different for a 12-truck carrier, but the problem is the same one. If a tool can read the inbox or update a load, it deserves the same scrutiny as a new employee with the same access. We covered what to check before connecting AI tools to dispatch and email in a separate piece.
Why the paperwork matters more after Montgomery
In May, the Supreme Court unanimously decided Montgomery v. Caribe Transport II. The case came out of an Illinois highway crash, not a theft. The question was whether federal law shields freight brokers from state-law claims that they negligently selected an unsafe carrier, and the Court held that it does not when the claim concerns motor vehicle safety. As several law firms have noted since, the opinion did not spell out what reasonable carrier-selection diligence actually looks like.
Even so, the ruling has made carrier-selection records a bigger deal. Brokers that can show a consistent, written vetting process are in a better position than those relying on habit and memory. Palmer’s warning in the CargoRex guide will sound familiar to anyone who has been through litigation: a written procedure that nobody follows can end up as evidence against you. The guide’s advice is to review carrier selection records with your own counsel, which is the right call.
What the people dealing with it recommend
The recommendations in the CargoRex guide are not exotic, and that is part of what makes them useful. Most of them are about slowing down at the handful of moments where a single message can move a load or a payment.
On verification, the interviewees kept returning to the idea of confirming the person and not just the company. That means calling back on a number you already have on file rather than the one in the email, rechecking a carrier whenever its contact details change, and continuing to vet after onboarding because accounts can be taken over later. For high-value freight, several suggested keeping loads off public boards altogether and sticking with carriers whose dispatchers you know by voice.
At the dock, the guide recommends checking several details at pickup, including container, chassis, plate, DOT number, and condition, with a person deciding what to do when something does not match. Timestamped gate photos make it much easier to reconstruct a disputed pickup later. Cornell summed up the attitude at NMFTA’s cybersecurity conference this year: “Fast is good, but slow is accurate.”
On the technology side, the advice is basic but often skipped. Turn on two-step sign-in for email, load boards, the TMS, and telematics. Remove access when people leave. Require a human to approve changes to delivery addresses, payment details, or carrier contacts. Watch for new mailbox forwarding rules, which are one of the more reliable signs that an inbox has been compromised.
And when something does go wrong, report it right away instead of waiting to be sure. The guide recommends calling local police and reporting cyber-enabled theft to the FBI through IC3, notifying the insurer, preserving every email, text, call log, and tracking record, and naming one person to own the response with a backup.
Keep reading
If the 2026 numbers have you looking harder at your own operation, these articles go deeper on the specific schemes and what to do about them. The broker impersonation piece follows one reported attempt to divert a $273,000 seafood load, and the response checklists are written for the first hour after something goes wrong.
- Compromised communications tied to 40% of stolen loads
- Freight fraud now starts in the inbox: how criminals borrow carrier identities
- A fake broker nearly redirected $273,000 in seafood
- Freight payment and load-change verification checklist
- Cargo theft prevention for small trucking companies
- Cargo theft response checklist: the first 60 minutes
- Double brokered load: what to do in the first 24 hours
- Fake Motus websites: how to spot FMCSA phishing sites
Frequently asked questions
Is cargo theft increasing in 2026?
Reported incidents are down, but losses are up. Verisk CargoNet recorded 33% fewer incidents in Q3 2026 than a year earlier, while estimated losses through September reached $718.9 million, a 39% increase. Thieves are going after fewer, more valuable loads, especially metals and technology.
What is strategic cargo theft?
Strategic cargo theft relies on deception instead of force. Criminals pose as a legitimate carrier, broker, or driver, or take over a real company’s accounts, so the freight is released to them through what looks like a normal transaction. Fictitious pickups are the most common example.
What is a fictitious pickup?
A fictitious pickup is when someone using a fake or stolen carrier identity arranges to collect a load and the shipper hands it over. CargoNet reported that fictitious pickups made up about one in four reported incidents in Q3 2026, up from 18% a year earlier.
Does Montgomery v. Caribe Transport II make brokers liable for cargo theft?
Not directly. The decision dealt with negligent-selection claims tied to motor vehicle safety after a highway crash, and it did not define a standard of care. It has, however, made documented and consistently followed carrier-selection procedures more important. Brokers should review their own situation with counsel.
Sources
CargoNet figures reflect incidents reported to its network in the U.S. and Canada and should be read as a floor. Figures marked “via CargoRex” come from the named organizations as summarized in the CargoRex guide.
- CargoRex: Cargo Theft and Freight Fraud Prevention Guide (CR-2026-11), November 2026
- Verisk CargoNet: Fewer Cargo Thefts, Bigger Losses (Q3 2026), November 4, 2026
- Verisk CargoNet: Cargo Theft Losses More Than Double to $304 Million in Q2, August 6, 2026
- Verisk CargoNet: Cargo Theft Losses Surge to Estimated $725 Million in 2025, January 22, 2026
- FBI/IC3: Cyber-Enabled Strategic Cargo Theft Surging (I-043026-PSA), April 30, 2026
- DLA Piper: Supreme Court rules freight brokers can be held liable under state negligence law, May 18, 2026
Related resources
Start with the verification step most thefts get around
Our freight payment and load-change verification checklist walks through the callback and approval steps for driver swaps, new delivery addresses, and changed payment details.