Published
It takes a carrier years to earn a good name with brokers. Someone who gets into that carrier's email can borrow it in an afternoon, book a load, and leave the real owner taking calls about freight their trucks never touched.
The old picture of freight fraud was a fake carrier: brand-new authority, a thin record, gone after one load. You still see that. But the bigger problem now is quieter. Instead of inventing a carrier, thieves try to become one that brokers already trust, by getting into its email, taking over its phone number, or buying its authority outright.
Below, we walk through the latest numbers, how these takeovers usually play out, and the handful of fixes that matter most for a small fleet or brokerage. Most of them cost nothing but an afternoon.
Cyber schemes now outnumber direct theft in reported stolen-load cases
Brittany Graft, chief operating officer of the carrier verification company Highway, shared some telling figures at the Women In Trucking Association's Accelerate! conference in Dallas this month. Of the stolen-load investigations reported to Highway in September 2026, 52% involved cyber schemes. Straight theft made up 46%, and ownership-change cases the last 2%.
The volume behind those cases is striking. Highway says it blocked 670,230 fraudulent emails and 119,022 fraudulent or spoofed phone calls in the third quarter alone. Back in July, its Q2 Freight Fraud Index had already put communication-based attacks at half of all the fraud it classified, up from 42.7% the quarter before.
Keep in mind these numbers come from one verification network's own investigations, not the whole industry. Still, the trend is hard to miss. Thieves are putting less effort into creating fake carriers and more into sounding exactly like real ones.
How a carrier account takeover plays out
Why go after an established carrier at all? Because broker onboarding is built to flag new authority, thin histories and details that don't line up. A carrier with years of clean inspections and a familiar dispatcher sails through. Whoever controls that carrier's inbox or phone inherits all of that trust.
The cases we read about tend to follow the same arc:
- Get the identity. Usually that's a phishing email made to look like it came from a broker, a load board or FMCSA, sending the reader to a lookalike login page. We've written about fake Motus portals and fake Truckstop and RMIS emails that do exactly this. Other times the thief simply pays a struggling carrier for its authority and contact details.
- Get in quietly. With the password, and sometimes an intercepted sign-in code, the thief starts reading the mailbox. Some attacks even run through a real Microsoft sign-in page, so a familiar screen shouldn't put you at ease.
- Learn how you work. Rate confirmations, regular lanes, broker contacts and the way your dispatcher signs off all teach the thief how to pass as you.
- Hide the trail. Thieves have been known to delete broker emails before the real carrier ever sees them, typically with a mailbox rule that quietly forwards or trashes messages from certain senders.
- Take the phones too. Caller ID is easy to fake, and some thieves try a SIM swap or number transfer so that when a careful broker calls back, the call goes to them.
- Book the load and collect. The freight is tendered to 'you,' picked up under your USDOT and MC numbers, and the trouble lands on your desk.
You'll notice there's no truck anywhere in the first five steps. According to Highway, some people buying carrier identities don't care about equipment at all. What they want is your name, your numbers and a way to answer your email and phone.
The load was delivered. So who hauled it?
Not every case ends with an empty trailer. During the Dallas session, one attendee described a load that was picked up and delivered, paperwork and all, under the USDOT and MC numbers of a small Michigan carrier. That carrier says it had nothing to do with it, and it had already been getting calls about shipments it never hauled.
The company that arranged the move was left trying to figure out who actually carried the freight and who should get paid. Whether that turns out to be identity theft or an unauthorized double-brokered load, the innocent carrier still pays a price: confused partners, disputed invoices and its name attached to someone else's scheme.
If calls like that start coming in, take them seriously. Write down every detail, then look for freight accounts opened in your name and unfamiliar inspections on your FMCSA record. If you think your own email might be involved, start with our guide on what to do in the first hours after a dispatch inbox is hacked.
Your MC number is not for sale or rent
Some owners get approached directly, often by someone offering cash to 'rent' an aged authority so they can skip the new-entrant period. In March 2026, FMCSA put out a bulletin telling carriers not to sell, buy or lease a USDOT or MC number unless it's part of a legitimate corporate deal, like a documented sale or merger of the company itself.
The agency was direct about what happens next. A USDOT number stays with the legal entity it was issued to, and FMCSA says it will inactivate numbers it finds being used by anyone else and revoke the related authority. Leasing equipment from owner-operators under the existing leasing rules is a separate matter and still allowed.
So the few thousand dollars on the table could cost you the authority you spent years building, and it hands a thief the exact reputation they need to steal under your name.
Seven fixes that make your carrier identity harder to borrow
You don't need a security department or another monthly subscription for any of this. Most of it is settings you already pay for. Start with the logins that can move freight or money: email, FMCSA/Motus, load boards, factoring and the bank.
| Fix | Why it matters | Where to start |
|---|---|---|
| Passkeys or an authenticator app | A stolen password stops being enough on its own. Passkeys hold up against fake login pages far better than text-message codes. | Email first, then load boards, factoring and banking. |
| One login per person | When everyone shares a password, you can't tell who did what or cut off one dispatcher who leaves. | List every shared login and give each person their own account. |
| Check mailbox rules and forwarding | Hidden rules are how thieves forward or delete broker emails before you see them. | Look in every mailbox for rules or forwarding nobody on your team set up. |
| SPF, DKIM and DMARC on your domain | These make it much harder for someone to send email that appears to come from your exact domain. | Look up your DMARC record and get it to enforcement. |
| Port-out PIN on your phones | Stops someone from moving the office or owner's number onto their own SIM card. | Call your mobile carrier and ask for a transfer PIN or port-out lock. |
| Call back on a number you already had | Caller ID and numbers inside an email can be faked. A number you saved months ago can't. | Keep a verified contact list for brokers and shippers and use it for every change. |
| Exchange paperwork through a portal | A rate confirmation sitting in a plain email attachment is a ready-made script for a thief. | Ask partners to send rate confirmations through their portal or load board. |
If you only get to two this week, make them these: move email to passkeys or an authenticator app, and call your phone company about a port-out PIN. Those two close the main ways a thief can answer as you. Not sure where your email stands? Our free exposure review checks public records for missing DMARC enforcement and lookalike domains, with no passwords or system access needed.
Never read a code to anyone, even someone you know
No real broker, load board or verification service will ever need your password or a one-time code. Highway has seen people pose as its own staff over the phone just to ask for one. If anyone asks, hang up and call back on the number you have on file.
Slow down most when a message changes something: a new pickup address, a revised rate con, different payment details, a request to install an app. Those are the moments thieves pick, and they're worth a two-minute phone call. The same goes for fake logistics apps that ask for permission to read your texts or forward your calls.
Reading about it helps, but practice is what sticks. A short authorized phishing test using freight-style lures shows you which messages your people would actually click, and our ongoing phishing practice for dispatch and billing staff keeps that habit sharp after the first round.
For brokers: check the carrier, then check the conversation
Carrier vetting tools are good at answering one question: is this a real carrier in good standing? A takeover attacks a different one: is the person emailing me really that carrier? A spotless profile won't help you if the email thread itself has been hijacked.
So verify the conversation, not just the company. Confirm dispatch details and any change to pickup, delivery, driver or truck by calling the number on record, never one from the message. Treat a new remit-to or factoring change as its own high-risk event, with a separate call-back and a second person signing off. Our freight payment verification checklist and freight change verification worksheet make that routine, and our page on cybersecurity for freight brokers covers the bigger picture.
If you want to see how fast a hijacked thread turns into a diversion, read about the fake broker who nearly redirected a $273,000 seafood load. And have a plan ready for the first 60 minutes after a suspected theft, when quick calls to the carrier, shipper and police count most.
Keep your own changes from looking like fraud
Tighter checks can trip up honest carriers too. At the same session, a carrier representative mentioned that just updating the business email on their FMCSA record set off fraud alerts with partners. Graft acknowledged the extra steps can be a burden and said Highway is working to cut down on alerts that aren't needed.
You can make life easier on your end. Before you change an email address, phone number, bank or factoring company, let your regular brokers and your factor know through a channel they already trust, and keep a dated note of the change. If an alert goes off, you'll have what you need to clear it quickly. And any change you didn't announce stands out right away.
Frequently asked questions about carrier account takeover
What is carrier account takeover in freight fraud?
It's when someone gains control of a real trucking company's email, phone number, load board login or FMCSA contact details and uses them to book and pick up loads as that carrier. Because the carrier's history is genuine, normal broker vetting usually passes.
How do criminals get into a trucking company's email?
Most often through phishing. A message that looks like it's from a broker, load board or FMCSA leads to a fake login page that captures the password and sometimes the sign-in code. Reused passwords, shared accounts and text-message codes that can be redirected through a SIM swap make it easier.
Are passkeys better than text-message codes for carriers?
Yes. A passkey is tied to your device and the real website, so a fake login page can't capture it and reuse it. An authenticator app is the next best choice. Text-message codes beat nothing, but they can be phished or redirected through a SIM swap.
Can I sell or lease my MC number?
Not by itself. FMCSA's March 2026 bulletin warns against selling, buying or leasing USDOT or MC numbers outside a legitimate corporate transaction, and says it will inactivate numbers used by anyone other than the entity they were issued to. Leasing equipment from owner-operators under the existing leasing rules is a separate matter.
What should I do if brokers call about loads I never hauled?
Write down every detail. Check your email for unknown forwarding rules and sign-ins, change passwords and turn on passkeys, and review your FMCSA record and load board accounts. Let your regular brokers and your factor know through contacts you already have, then report it to FMCSA and the FBI's Internet Crime Complaint Center.
Want this done for you?
A small carrier can handle everything in this guide, but it's hard to find the hours while you're keeping trucks moving. That's why we put together the Freight Fraud Lockdown. In one fixed-price engagement we get your email domain to DMARC enforcement, review two-step sign-in on your email, FMCSA/Motus, load board, factoring and bank logins (you keep your passwords), search for lookalike domains, write a call-back procedure your dispatchers will actually use, and run one authorized phishing test with your team.
Not ready for that yet? Request a free exposure review to see what a thief could learn about your company from the outside. And download our incident response plan template so everyone knows who to call if something gets through.
Related resources
Close the gaps in one visit, at one price
The Freight Fraud Lockdown covers email domain authentication through to enforcement, a two-step sign-in review across your email, FMCSA/Motus, load board, factoring and bank logins, a lookalike-domain search, a written call-back procedure, and one authorized phishing test. It's $950 for up to 10 people, and $650 for our first three trucking clients.