Published
A real carrier name and a familiar email address do not prove that the right person is controlling the conversation. Here is how compromised communications can turn into stolen freight—and what smaller carriers and brokers can do about it.
A carrier can have active authority, legitimate insurance, years of operating history, and a familiar email address. None of those facts proves that the person sending the next message still controls the account.
That distinction sits at the center of Highway’s Q3 2026 Freight Fraud Index. Highway attributed 40.2% of the stolen loads reported through its network during the quarter to compromised communications. The company recorded 184 stolen-load reports in total. That count was down from the previous quarter but remained higher than the same period in 2025.
Those figures need the right context. They describe incidents reported to Highway, a carrier-identity and freight-fraud technology provider. They are not nationwide cargo-theft totals, and they do not mean that 40% of every stolen load in the United States began with an email compromise. Still, the finding is useful because it identifies a control gap that smaller carriers and brokerages can address: a business may verify the carrier once and then trust every later message that appears to come from it.
Highway’s report and FreightWaves’ detailed review point to the same practical lesson: freight verification cannot end when a carrier passes onboarding.
What “compromised communications” means in freight
Compromised communications are different from a simple spoofed email.
A spoofed message may imitate a company’s name or use a lookalike domain. A compromised account is more difficult to recognize because the message can come from the real mailbox. It may appear inside an existing conversation, use the correct signature, refer to an actual shipment, and arrive at the time the recipient expects an update.
The criminal may also know which dispatcher handles the account, which documents are normally exchanged, and how the carrier and broker speak to one another. That knowledge can make an unusual instruction feel routine.
Email is not the only channel involved. A stolen identity may be reinforced through spoofed telephone calls, changed FMCSA contact information, a compromised load-board account, or access to a transportation management system. Highway separately reported a sharp year-over-year increase in fraudulent and spoofed calls blocked by its systems and a quarterly increase in reported carrier-ownership changes.
The company name may be legitimate. The MC number may be legitimate. The conversation may even be taking place in a real email thread. The problem is that the wrong person is controlling one or more of those trusted channels.
How a stolen email account can lead to a stolen load
Not every cargo theft follows the same sequence. The FBI, however, has described a recurring multi-step pattern in cyber-enabled strategic cargo theft. It helps explain how a digital compromise can become a physical loss.
1. The attacker creates a reason to click
The opening message often looks like normal freight work: a carrier packet, broker agreement, load document, service complaint, portal notice, or request to review a rating.
The link may lead to a fake sign-in page. In other cases, the recipient is prompted to download a file or install a document viewer. The FBI has warned that criminals also use these lures to install legitimate remote monitoring and management software, giving them continuing access to a carrier or broker’s computer.
The person who clicks may not see an obvious failure. The document might open, the sign-in page might display an error, or the attacker might redirect the user to a legitimate website afterward.
2. The attacker gets inside a trusted account
Once the attacker has credentials, a stolen session, or remote access to a device, the next objective is often persistence.
In an email account, that may involve creating a forwarding rule, hiding selected messages, deleting warnings, registering a new authentication method, or authorizing an outside application. Access to a load board or TMS may expose additional shipment details and business relationships.
Multifactor authentication helps, but it is not a complete answer. A convincing phishing page can sometimes capture a live session, and an employee can be tricked into approving an unexpected sign-in or granting an application access. Sensitive freight accounts should use phishing-resistant methods such as passkeys or security keys where the service supports them.
3. The attacker studies the operation
Freight email contains more than messages. It can reveal rate confirmations, pickup numbers, driver details, delivery locations, customer contacts, factoring relationships, and the timing of active loads.
An attacker can watch those conversations and wait for a useful moment. A last-minute change is easier to accept when the message contains details that only the carrier, broker, shipper, or driver should know.
This is why a correct load number or an accurate rate confirmation should not be treated as identity verification. Those details may be the very information exposed by the compromised account.
4. The attacker communicates as the trusted company
The criminal may use the real mailbox to request shipment details, send a manipulated rate confirmation, substitute a driver, change a pickup, or provide a new destination. If the receiving party relies on the existing thread instead of an independent verification step, the instruction can move through the operation without creating immediate suspicion.
The same access can support payment fraud. A criminal may change factoring instructions, a remit-to account, or quick-pay details after observing how the business normally handles those requests.
Our freight payment and load-change verification checklist provides a repeatable callback and approval process for these situations.
5. The digital deception becomes a physical theft
The freight may be picked up by someone presenting apparently valid information, moved by an unwitting carrier, diverted to another facility, or transferred to different equipment. By the time the legitimate carrier or broker recognizes the problem, the cargo may already have been cross-docked or transloaded.
The FBI’s cyber-enabled strategic cargo theft warning describes criminals using compromised accounts, fraudulent load-board listings, manipulated bills of lading, changed FMCSA information, and partially unwitting drivers to redirect freight for resale.
Why onboarding alone does not solve the problem
Carrier onboarding answers important questions about the business at a point in time. It does not continuously prove who controls the carrier’s mailbox, telephone number, load-board profile, or operating authority.
This creates two distinct verification jobs:
- Verify the business. Confirm the carrier or broker’s authority, insurance, operating information, and other required records.
- Verify the person and the instruction. Confirm that the individual communicating now is authorized to request this load, change this driver, redirect this freight, or alter this payment.
FMCSA recommends comparing supplied contact information with its SAFER records and calling the listed company when the information does not match. That is an important check, but official records are not infallible. The FBI has documented criminals changing FMCSA contact information as part of a broader compromise.
Use several independent signals. Compare the approved carrier record, known contacts, driver and equipment details, load information, recent account changes, and the circumstances of the request. A single database, caller ID display, email address, or document should not authorize a consequential change by itself.
Seven controls smaller freight businesses can put in place
The goal is not to make every load difficult to move. It is to give employees a short, dependable process for the moments when an instruction could change custody, destination, access, or payment.
1. Protect the accounts that move freight and money
List the email, load-board, TMS, FMCSA/Motus, factoring, fuel-card, and banking accounts used by the operation. Give employees individual accounts where possible, require MFA, remove former users promptly, and protect account-recovery methods.
Ask the administrator to show evidence—not simply confirm—that MFA is enforced for sensitive users and administrators.
2. Review mailbox persistence and sign-in activity
For Microsoft 365 or another business email service, review:
- External forwarding and inbox rules
- Unfamiliar sessions and sign-in locations
- New authentication methods or recovery details
- Unexpected administrator-role changes
- Third-party applications with mailbox access
- Messages moved to hidden folders or automatically deleted
These checks should be part of the response whenever a partner reports an unauthorized load or message sent in the company’s name.
3. Treat rate confirmations as sensitive shipment data
An ordinary email attachment becomes available to anyone who controls the mailbox. Where practical, use an authenticated portal or secure delivery method for rate confirmations and other shipment documents. Limit access to the people who need the information and remove access when their role ends.
A secure document system does not replace identity verification. It reduces how widely sensitive details are exposed and can provide better access records than an attachment moving between inboxes.
4. Require a callback for consequential changes
Use a telephone number already stored in an approved record—not the number in the incoming message. Require a second approval for changes involving:
- Pickup or delivery locations
- Drivers, tractors, trailers, or substitute carriers
- Cross-docks or freight transfers
- Bank, factoring, remit-to, or notice-of-assignment details
- Account recovery, MFA, or administrator access
Caller ID is not verification. A criminal can spoof the number that appears on the screen.
5. Reverify after ownership or contact changes
A long operating history does not tell you who controls the company today. Escalate unexplained changes to ownership, email domains, telephone numbers, insurance, payment information, FMCSA contacts, or the people representing the carrier.
Document the reason for the change, who verified it, which independent contact method was used, and who approved the updated record.
6. Connect the office check to the dock release
Pickup staff should know the approved carrier, driver, tractor, trailer, and pickup reference. A replacement driver or different piece of equipment should trigger confirmation with dispatch before the freight is released.
The fleet cybersecurity checklist connects these shipment checks with account protection, remote-access controls, and dispatch continuity.
7. Prepare for the first hour of an account compromise
If a suspicious message may have come from a real account, do not continue investigating through that same mailbox. Contact the affected business and your IT responder through known channels.
Identify active loads and verify their current instructions. Preserve the messages, shipment records, account alerts, sign-in logs, and a timeline. Revoke suspicious sessions and access as directed by the responder. If money moved, call the bank immediately. Report suspected cargo theft to local law enforcement and cyber-enabled theft to the FBI through IC3.
Questions to take to your IT provider and operations team
A short review should produce evidence your business can keep:
| Question | Useful evidence |
|---|---|
| Is MFA enforced on dispatch, email, load-board, and administrator accounts? | Current policy or account report showing enforcement and documented exceptions |
| Can an employee automatically forward freight email outside the company? | Mail-flow and forwarding-rule review |
| Which applications can read or send business email? | Approved application and OAuth-access inventory |
| Can we identify who changed a load, destination, carrier, or payment record? | TMS or platform audit-log demonstration |
| What happens when a carrier’s ownership or contact details change? | Written reverification and approval procedure |
| Can the team verify a change after hours? | Current callback list and named escalation contact |
| How do we respond if a partner reports an unauthorized message? | Account-compromise and active-load response procedure |
How Securing Your Business helps freight companies
Smaller carriers and brokerages rarely need another dashboard that no one has time to manage. They need the accounts tightened, the verification process written down, and employees prepared to use it when a convincing request arrives.
Freight Fraud Lockdown
Our Freight Fraud Lockdown is built for small trucking companies and freight brokers. The engagement addresses five openings commonly used in freight fraud: email-domain impersonation, weak access to important accounts, lookalike domains, inconsistent callback procedures, and phishing lures aimed at office and dispatch staff.
The work includes a practical login review, a one-page callback procedure for load and payment changes, and an authorized freight-themed phishing test. We coordinate with your existing IT provider when one is already involved.
Email and Microsoft 365 Security
If the main concern is a mailbox or Microsoft 365 environment, our Email and Microsoft 365 Security service can be scoped around MFA coverage, administrator access, forwarding and inbox rules, sign-in protection, sharing, and available audit records. We can perform the agreed review, implement authorized improvements, or provide findings for your current provider to address.
Managed Phishing Testing and Staff Training
Policies only help if employees can use them under pressure. Our managed phishing simulations can use controlled freight scenarios such as an unexpected carrier packet, rate confirmation, load-document link, payment change, or portal sign-in request. We handle campaign setup, follow-up learning, and reporting.
For businesses that need a broader independent check of identity, devices, backups, and incident readiness, the Freight Broker Cybersecurity Assessment explains how those safeguards can be reviewed through the Business Security Baseline.
The person behind the message still has to be verified
The Highway finding does not mean every stolen load begins with a hacked inbox. It does show why a legitimate carrier record and a familiar email thread are no longer enough on their own.
Protect the accounts. Limit access to shipment details. Verify consequential changes through a channel the requester did not supply. Give employees permission to pause an urgent instruction when the identity or authority behind it cannot be confirmed.
If you want a practical starting point for a small carrier or brokerage, review the Freight Fraud Lockdown. We will confirm whether the service fits your operation before work begins.
Frequently asked questions
What are compromised communications in freight fraud?
The phrase generally describes a communication channel controlled or misused by an unauthorized person. That can include a compromised carrier or broker mailbox, load-board account, TMS login, telephone channel, or business identity. A message may come from a real account even though the legitimate owner did not send it.
Does MFA stop carrier email account takeover?
MFA substantially improves account security, but no single control stops every takeover. Businesses should combine phishing-resistant MFA where available with protected recovery methods, sign-in monitoring, forwarding-rule reviews, limited application access, and independent verification of important instructions.
Is a rate confirmation proof that a load request is legitimate?
No. A rate confirmation may contain accurate shipment information and still be stolen or manipulated. Confirm the sender’s authority and verify changes to the driver, destination, equipment, custody, or payment through a known contact method.
What should we do if a freight partner says our email sent an unauthorized message?
Contact the partner and your IT responder using established contact information outside the disputed email thread. Verify active loads, preserve evidence, review account activity, and coordinate containment. If cargo or funds are at risk, contact law enforcement or the bank immediately as appropriate.
Sources
Highway’s figures cover stolen-load reports made through its own network; they are not nationwide cargo-theft totals.
Related resources
Close the openings freight fraud relies on
The Freight Fraud Lockdown covers email-domain authentication, a sign-in review across your email, FMCSA/Motus, load-board, factoring, and bank accounts, a lookalike-domain search, a one-page callback procedure for load and payment changes, and one authorized phishing test. It's $950 for up to 10 people, and $650 for our first three trucking clients.