Menu

Trucking & Logistics

Valid Carrier Credentials Are Not Enough: Protecting High-Value Technology Loads

Cargo thieves are targeting high-value technology freight, including through carrier impersonation. Learn what brokers, shippers, and carriers can verify before a load moves.

Blog post – By

Published

A carrier's USDOT or MC number can be valid while the person booking or collecting the load is an impostor. Here are checks freight teams can make before release.

Why technology freight is an attractive target

A real USDOT or MC record tells you that a carrier exists. However, it does not tell you who is emailing dispatch or standing at the dock.

On October 21, 2026, supply-chain risk company Overhaul reported more than $150 million in losses involving AI equipment. It said thefts of data-center equipment, computing components, and chips were up 34% since 2024, the value stolen had increased by more than 110%, and deception featured in 92% of the high-value technology shipments in its report. Those are Overhaul's figures. The company sells cargo-monitoring and risk products, and its public announcement does not detail the full dataset or methodology; treat the numbers as vendor-reported, not as an independently verified industry-wide measure.

Servers, networking equipment, storage devices, and chips can put a great deal of value on a single trailer. A stolen shipment may also delay a project and leave operations, claims, accounting, and customer-service teams sorting out what happened. The impact depends on the shipment and contract.

Verisk CargoNet put reported cargo-theft losses at $304.6 million for the second quarter of 2026, up from the prior year, despite fewer incidents. It also noted continued thefts of enterprise-grade computer and networking equipment. The figures do not mean every technology load is at risk; they show why a routine release process may not be enough for unusually valuable freight.

How a valid carrier identity can be used by the wrong person

The FBI lists identity theft, fictitious pickups, account takeovers, double brokering, and fraudulent carriers among cargo-theft tactics. A thief may copy a legitimate carrier's details, take over an email or load-board account, or redirect a shipment after booking.

In an October 2026 case, federal prosecutors alleged that a defendant and others took control of several motor-carrier companies, including their USDOT and MC numbers, business email accounts, and owners' identities. The indictment says the group used those companies' established reputations to obtain at least 24 shipments worth more than $12 million. The charges are allegations, not proof of guilt; the defendant is presumed innocent unless proven guilty.

A long operating history is useful, but it cannot confirm who is acting for the carrier today.

  • Carrier impersonation: copying a legitimate carrier's name, operating details, documents, and branding while using a lookalike email address or different phone number.
  • Account takeover: using stolen email, load-board, onboarding, or dispatch credentials to communicate through an account that appears genuine.
  • Business takeover: controlling the carrier itself—or its public records, email, and owner identity—so ordinary vetting results appear legitimate.
  • Double brokering or fictitious pickup: passing a load to an unauthorized carrier or arranging for a real driver to collect freight under false instructions.
  • Post-booking redirection: changing the driver, equipment, route, cross-dock, or delivery destination after a legitimate booking.

Use two chains of custody: freight and authority

Track authority as carefully as the freight itself: who approved the carrier, who authorized a change, how that person was verified, and where the decision was recorded.

Use the checks below as a starting point and adapt them to your contracts, insurer requirements, facility procedures, and risk tolerance. When an instruction changes, call a number already on file or obtained independently—not a number supplied in the change request.

  • Carrier selection — Verify the legal name, authority, USDOT/MC details, established contact information, insurance, operating history, and recent material changes. Pause for new authority, recent ownership or contact changes, mismatched domains or phone numbers, or unusual urgency. Retain dated carrier records, the source of contact details, and reviewer approval.
  • Pre-pickup — Verify the named dispatcher, driver, tractor, trailer, plate, pickup number, appointment, and authorized facility contact. Pause for last-minute driver or equipment substitutions or contacts that cannot be reached through a known channel. Retain approved driver and equipment details, callback records, and exception approval.
  • Dock release — Match the arriving driver and equipment with the pre-approved record; confirm the pickup number and that it is not broadly shared. Pause for different drivers, trucks, trailers, carrier names, pickup times, or paperwork. Retain the gate log, timestamp, approved exception, seal, and bill-of-lading details.
  • In transit — Verify the approved route, independent tracking, check-in schedule, and who may change instructions. Pause for tracking gaps, unexpected stops, new cross-docks, route changes, or delivery-address changes. Retain tracking history, call notes, original and revised instructions, and the approver.
  • Delivery — Verify the receiver, appointment, location, seal status, and proof of delivery. Pause for requests to deliver elsewhere, hold at an unfamiliar yard, or transfer to another vehicle. Retain receiver confirmation, arrival and seal records, and signed delivery evidence.

A last-minute driver change: the callback test

A carrier asks to substitute a driver shortly before pickup. The dispatcher should not rely on a familiar voice, caller ID, or a reply to the email that requested the change. Put the release on hold and:

  1. Call the carrier using the number already in your approved contact record. If the contact list is missing or outdated, find another independently established number; do not use details supplied only with the change request.
  2. Confirm that the carrier authorized the substitution and record the name and role of the person who approves it.
  3. Verify the replacement driver's name and the tractor, trailer, plate, pickup number, and appointment against the revised load record.
  4. Tell the pickup facility which driver and equipment are approved. Make sure the old pickup details are no longer treated as valid.
  5. Get the required second approval, record the callback number's source, time, decision, and approver, then release the load. If any detail cannot be confirmed, keep the hold in place and escalate.

Five controls smaller freight businesses can implement now

These checks do not require a large security team. They do require clear contacts, named approvers, and permission for staff to hold a load when details do not match.

  1. Set the extra checks before a load is booked. Consider value, resale demand, customer impact, commodity, route, and the cost of delay—not just a dollar threshold. Limit access to sensitive cargo details.
  2. Keep a contact list for carriers, brokers, shippers, receivers, warehouses, insurers, and after-hours approvers. Record where each number came from, and update the list after confirmed changes to ownership or contact details. A public record does not authenticate the person using it.
  3. Require a second approval for changes to the driver, equipment, carrier, cross-dock, destination, payment details, factoring relationship, or account recovery. Make the rule apply after hours and during busy periods too.
  4. Protect the accounts used to send instructions. Use individual accounts and multifactor authentication for email, load boards, TMS platforms, and carrier portals where supported. Remove former staff promptly. Ask your IT provider to check unfamiliar sign-ins, mailbox forwarding rules, new administrators, and unexpected MFA or recovery changes. Email authentication can help identify some spoofing, but it cannot prove a mailbox is uncompromised.
  5. Rehearse a last-minute change. Ask dispatch, the shipping desk, and accounts payable what they would do if a familiar carrier requested a new driver and route shortly before pickup. Have them find the callback number, identify the approver, and show what they would record. Fix gaps such as missing contacts, shared logins, or an unreachable after-hours approver.

Warning signs that deserve a pause

Freight changes can be legitimate, and no single item below proves fraud. Pause and verify when details conflict or someone pressures staff to skip the normal process. Do not confront a suspected criminal.

  • A carrier's authority is valid, but the email domain or phone number differs from the established record.
  • Ownership, address, phone, email, or insurance details changed recently without a clear explanation.
  • The arriving driver, tractor, trailer, plate, or carrier name does not match the approved pickup record.
  • A new contact resists a callback through the company's known number.
  • The load is re-brokered, cross-docked, or transferred without prior authorization.
  • Delivery instructions change after pickup, especially to a yard, warehouse, or receiver not named in the original records.
  • Someone asks staff to communicate outside the approved platform or install an unfamiliar tracking application.
  • Urgency, threats, or a promised premium are used to skip a review.

If a high-value load may be compromised

Move quickly, but keep people safe and preserve the original records.

  1. Locate and protect the freight. Contact the driver, shipper, pickup facility, receiver, and legitimate broker or carrier through known channels. Stop a release, transfer, or delivery when it can be done safely and lawfully.
  2. Freeze unverified changes and payments. Hold new route, destination, carrier, factoring, or payment instructions until they are independently confirmed.
  3. Preserve the original records. Retain emails with headers, texts, call logs, rate confirmations, bills of lading, onboarding documents, pickup records, camera footage, account logs, and tracking history.
  4. Secure affected accounts. From a known-clean device, reset compromised credentials, revoke active sessions, remove unauthorized rules or administrators, and check connected load-board, TMS, and payment accounts. Preserve relevant evidence before changes where practical.
  5. Report promptly. Contact local law enforcement when theft may be occurring, notify the insurer and affected platform, and report internet-enabled fraud through the FBI's Internet Crime Complaint Center. The FBI cargo-theft page lists reporting routes and protective measures.

A carrier number is one check—not the decision

A valid carrier number, insurance record, and strong history are all useful checks. None confirms that a particular person, driver, or last-minute instruction is authorized. Put the checks together, record who approved the load, and verify again when the people or instructions change.

Frequently asked questions

Is a valid USDOT or MC number enough to verify a carrier?

No. It confirms that a carrier record exists, but it does not prove that the person contacting you controls that carrier or is authorized for the load. Compare the identity, contact channel, driver, equipment, and current instructions with independently obtained records.

What is carrier identity fraud?

Carrier identity fraud occurs when someone uses a legitimate carrier's name, operating authority, documents, accounts, or other identifying information without authorization. The criminal may use a lookalike domain or take over a real business account or company identity.

How should a warehouse verify a high-value freight pickup?

Before release, compare the arriving driver, carrier, tractor, trailer, plate, appointment, and secure pickup information with the pre-approved record. Any substitution should follow a documented callback and approval process before the freight leaves.

Does GPS tracking prevent strategic cargo theft?

No. Tracking can help detect a deviation and locate equipment, but it does not prove that a pickup or destination change was authorized. Assign someone to review alerts and define how the team responds to a tracking gap or route change.

What should we do when a carrier changes a driver or delivery location?

Hold the change, call an established contact using independently sourced information, confirm who has authority to approve it, obtain the required second review, and retain the decision record. Do not rely only on the phone number or link in the change request.

Where cybersecurity verification helps—and where it does not

The business accounts behind freight operations deserve the same scrutiny as the load itself. The free Zero-Access Business Exposure Review checks public domain, email-authentication, lookalike-domain, website, and internet-facing service signals. It cannot authenticate a carrier, inspect a private account, validate a load, or determine whether a business has been compromised.

When internal evidence is needed, the $1,995 Business Security Baseline can verify agreed safeguards such as MFA, administrative access, mailbox rules, and recovery readiness. It is a business-IT security assessment—not a cargo-security service, carrier-vetting service, transportation-safety review, or FMCSA compliance audit.

Sources

The sources below provide the original reporting and agency guidance. Overhaul's figures are vendor-reported; the DOJ case is an indictment, not a finding of guilt.

Need an evidence-backed starting point?

The free Exposure Review shows what is publicly observable. The Business Security Baseline verifies the essential controls protecting the business.

Free Zero-Access Exposure Review™See the Baseline