A remote hire may need access to loads, customer records, and email. Here is how trucking companies can verify who is working and limit what their account can do.
The loads are booked. The access question is still open.
Your new remote dispatcher is answering messages. Loads are getting booked. The work appears to be getting done. But who is actually using the account?
If the person you hired shares the login or quietly hands work to someone else, an unapproved third party could see customer contacts, pickup details, shipment schedules, and billing records. Depending on the permissions, that person might also change instructions or export data.
Remote worker fraud in trucking is an access problem as well as a hiring problem. For a small carrier without an internal security team, the practical job is to connect the person you approved with the accounts and devices they use.
Why remote worker fraud deserves a closer look
In an October 14, 2026 FleetOwner article, NMFTA cybersecurity engineer Kenneth A. Heskett examines fraudulent remote employment and the risk of work being passed to unapproved third parties. It raises a useful question for fleet owners: does your hiring process connect to your account-access process?
The issue is receiving fresh federal attention. In an October 13, 2026 advisory, the FBI warned that North Korean IT-worker schemes increasingly use paid facilitators to participate in interviews, support identity deception, and keep employer laptops connected in the United States. Some schemes subcontract entire jobs.
The same day, the Justice Department announced enforcement actions involving an alleged scheme affecting more than 70 U.S. employers. Separately, it described September searches and other actions at more than 40 known or suspected laptop-farm residences in Texas, with approximately 187 laptops and keyboard, video, mouse (KVM) devices seized. Charges remain allegations; defendants are presumed innocent unless proven guilty.
Those announcements do not establish a campaign against trucking dispatchers. They show how a hiring process and a company-issued laptop can still leave an employer mistaken about who is doing the work.
What an unapproved worker could reach in a trucking business
Consider an illustrative scenario: a carrier hires an evening dispatcher and gives them a shared dispatch login. The dispatcher sends that password to a substitute who covers part of the shift. The substitute was never approved, but now has the same access. A shared account also makes it harder to determine who performed a particular action.
A legitimate outside dispatch service can be part of your operation; agree which people are approved and how substitutions are controlled. The risks below are potential consequences of excessive access, not findings about a particular fleet. Available permissions vary by platform and subscription.
Open the permissions for the role, rather than relying on its job title. Ask these questions with the person who administers each system:
- Business email: Can the worker read historical conversations, create forwarding rules, or send as another person?
- Transportation management system (TMS): Can they view every load, export customer information, or change delivery instructions?
- Load boards and customer portals: Can they change company contacts, recovery details, or other users?
- Billing and factoring systems: Can they view bank details, edit payment instructions, or approve payments?
- Shared files: Can they download driver records, customer agreements, or documents outside their role?
1. Connect hiring approval to account creation
Use a short handoff between the person hiring and the person setting up access. Record the approved worker, role, supervisor, assigned device, and systems needed. Keep identity documents in the restricted hiring process, not in a general dispatch spreadsheet.
Verify employment history through independently obtained contacts where practical. Review unexplained changes in identity, equipment delivery, or onboarding details through a consistent process. If a staffing agency supplies the worker, ask how it verifies personnel and approves replacements.
The FBI's January 2025 guidance recommends identity checks throughout hiring and employment, as well as review of staffing firms' hiring practices. Put an explicit rule in the agreement: no credential sharing or substitution without approval.
2. Give each person an account and only the access needed
Replace shared dispatcher credentials with individual accounts where the platform supports them. Use delegated access for a shared mailbox rather than distributing one password. If a platform cannot provide separate users, document that limitation and ask the provider about supported alternatives.
Separate routine dispatch work from account administration and payment approval. Require multifactor authentication (MFA), and ask about phishing-resistant options such as passkeys or security keys for sensitive accounts. NIST's small-business guidance recommends MFA, limited access, restricted administrative privileges, and removal of access when needs change.
MFA helps protect a login. It cannot establish that the account holder has not intentionally handed over an authenticated session or allowed someone else to operate the device. Dispatch account security still depends on who is approved to use it.
3. Verify the device and approved remote-access tools
Ask your IT provider or device administrator to show which device is assigned to the worker, whether it is managed, and which remote-control tools are installed. Restrict ordinary users' ability to install unapproved remote-access software.
The FBI's July 2025 warning explains how U.S.-based facilitators can host employer devices and enable remote access. A U.S. sign-in location alone therefore does not establish who is operating the computer.
Keep a documented support process so workers know who may request remote control and how to verify the request. If you permit personal devices, agree on security requirements and support boundaries before granting access.
4. Require separate verification for freight and payment changes
An approved account should not give one person unchecked authority over every consequential change. Require second-person approval and, for outside requests, an independent callback before acting on the changes below.
Use a number already held in trusted records, not one supplied in the request. Record who requested, verified, and approved the change. Build these steps into after-hours dispatch as well as the daytime office.
- New bank or factoring instructions.
- Unexpected delivery-location or pickup changes.
- Substitute carriers or drivers.
- Changes to account administrators or recovery contacts.
5. Make access removal a verified task
Before granting access, identify who can revoke it in each system, including platforms outside Microsoft 365. The owner may need a separate contact for the TMS, load board, customer portal, and factoring account.
When someone leaves or a contractor changes personnel, remove their access, revoke active sessions where supported, and review forwarding rules, connected applications, and shared links. Rotate any credentials they knew that remain in use.
Keep a dated record of completion and unresolved exceptions. Disabling business email should not be treated as proof that TMS, load-board, or factoring access has ended.
Investigate behavior without guessing at identity
Look for combinations of facts: an unexplained device change, unapproved remote-control software, unusual exports, and a request for broader access than the role needs.
The FBI's October 2026 advisory emphasizes that no single indicator reliably identifies a fraudulent IT worker and warns that aggressive filters can harm legitimate employees.
A camera problem, accent, overseas connection, or second job alone does not establish identity fraud or data theft. Use consistent verification and documented security evidence. Separate performance concerns from unauthorized access.
If you suspect someone else is using the account
Bring the owner, hiring manager, and IT responder together promptly. Preserve onboarding records, account logs, relevant messages, and device details. Have responders coordinate containment without delaying action against ongoing harm.
Disable suspicious access and revoke sessions as appropriate. Preserve the device before wiping or reassigning it. Review sensitive downloads, forwarding rules, account changes, and recent freight or payment instructions.
Use known contacts to confirm questionable instructions with customers, drivers, and financial providers. If funds moved, contact the bank immediately. Report suspected cybercrime to IC3 and follow your incident plan for insurer, customer, or other notifications with the appropriate advisers.
Start with the accounts behind your next load
Choose one remote role this week. Identify the approved person, assigned device, accessible systems, change authority, and access-removal owner. Keep the evidence and assign any gaps.
Transportation cybersecurity includes the office workflows that move freight and money, not just the equipment on the road. Knowing who can open a load record or change a payment is a useful place to start.
Related resources
Verify the safeguards behind dispatch access
The $1,995 Business Security Baseline verifies agreed internal safeguards for businesses with up to 25 employees; larger businesses receive a confirmed quote. Scope may include Microsoft 365 identity and access, device-protection evidence, and available logging. Confirm any TMS or load-board review separately. This is a security assessment, not a hiring background check or incident-forensics service. The free exposure review checks public signals only; it cannot verify who uses a private dispatch account.