Published
Verify unexpected registration requests through official FMCSA channels before signing in.
Received an unexpected FMCSA or Motus update email? Verify it before signing in. start at FMCSA's registration and fraud-alert page to check current notices instead of relying on a link in an unexpected message. A familiar subject, logo, or urgent compliance language does not authenticate a request. Before entering information, follow the current Motus route published by FMCSA.
If the official FMCSA page does not resolve your question, contact the agency using contact details found independently, not details supplied in the unexpected message.
Check official FMCSA notices before acting
FMCSA's registration fraud-alert page is the place to check for current agency notices. An unexpected notice, subject line, or logo does not authenticate a message by itself.
Not every email that mentions Motus or FMCSA is fraudulent, and carriers should not ignore genuine registration obligations. Confirm the requested action through the independently reached official FMCSA route before doing anything else.
How to verify an unexpected Motus request
Don't click a link in an unexpected email to check it. Instead, open FMCSA's official registration page independently and follow its current Motus route. Confirm an alert or requested action through a contact method you established separately.
If you still aren't sure whether a request is genuine, contact your compliance provider or FMCSA using details you looked up independently, not ones supplied in the suspicious message. Follow any additional authentication steps only after starting from that trusted route.
Use a trusted route, not a list of fake domains
Use FMCSA's fraud-alert page for current agency notices, then follow the current Motus route published there. Open that route independently before entering account information.
If a destination differs from the official route you established independently, stop and contact FMCSA through its published contact page.
What should I do if I clicked or entered my password?
What happened matters. Opening an email is different from clicking a link without submitting information, entering a username and password, approving a sign-in or authentication prompt, or downloading and executing a file.
If you entered Motus credentials or approved a sign-in prompt, contact your account administrator promptly. Reopen Motus from the current route on FMCSA's official site, reset the affected password, revoke active sessions where available, and check the Motus record for unauthorized contact or recovery-detail changes. Change any reused password on other accounts; do not assume a password reset alone guarantees recovery.
If you granted an app or other access, ask the administrator to review and revoke unfamiliar access. If you notice unexpected account changes, preserve what you see and ask FMCSA or your account administrator to verify them through established channels.
If an email account connected to Motus may also be affected, secure it from a trusted device: reset its password, revoke unfamiliar sessions, and check recovery details and forwarding rules. A compromised email account could be used to intercept account recovery messages.
If a file was downloaded, do not open or execute it. If it was opened or run, treat that device as potentially compromised and ask your IT provider or another qualified responder to inspect it before normal use.
Preserve the original email, including headers if possible, and report the attempt through the FMCSA Contact Center and the FBI's Internet Crime Complaint Center.
How can our team recognize the next fake compliance notice?
The same pattern – an urgent compliance email pointing to a lookalike domain – shows up under different names. A few habits make it easier to catch.
- Keep a saved bookmark for FMCSA's official registration page and use its current Motus route, so no one has to rely on an emailed link.
- Decide who verifies unexpected compliance-update requests and how, before the next one arrives.
- Ask your IT provider to review relevant email and sign-in activity when a person submitted credentials, approved access, downloaded a file, or noticed a change. Use the alert page for current indicators rather than relying on an old domain list.
- Remind staff to verify the complete site address through the official FMCSA route before signing in.
- Practice the independent verification and reporting steps in a controlled exercise; do not ask staff to install software or disclose real credentials.
Sources
Related resources
Would your team recognize the next fake compliance notice?
Help dispatch, compliance, and office staff practice recognizing suspicious requests before they act. Explore managed phishing testing and staff training for your business.