A broker calls about a delivery change your dispatcher never sent. The driver is already on the road. Here’s what to do first.
A suspicious email is a warning, not proof
An email that appears to come from your address could mean a compromised mailbox—or a forged sender or lookalike address. The message alone does not prove someone accessed your account. Let a qualified responder investigate while you protect the operation.
Protect active loads and payments first
Put one owner or manager in charge of coordinating dispatch, billing, and technical support. Keep a brief timeline of what happened and decisions made.
- Call your IT provider at an established number. If you do not have one, use your email provider’s official support route and seek qualified incident-response help.
- Check for unexpected changes to loads in transit, delivery instructions, driver or carrier assignments, bank details, and factoring instructions. Prioritize anything moving now or awaiting payment.
- Verify each change using a known phone number or another trusted channel—not the suspect email thread. Pause unverified changes and transactions. Tell drivers how to confirm instructions; they should call dispatch when safely parked. If freight may be at risk, contact the relevant broker, shipper, and receiver through known channels, and notify law enforcement if theft is suspected.
Ask for more than a password reset
For Microsoft 365, ask your administrator or responder to contain access, revoke active sessions, review sign-in methods and connected apps, check forwarding and mailbox rules, and examine activity logs. Ask what they found and what remains unknown. Being able to sign in again does not mean the investigation is complete.
Preserve evidence and act quickly if money moved
Keep original messages, load records, payment details, and your timeline. Ask the responder to preserve relevant logs. Do not delete the account, wipe devices, or clear messages on your own.
If money was sent, call your bank’s fraud team immediately and ask about recall options; do not wait for the investigation. Recovery is not guaranteed. Report suspected online crime to IC3 and follow your cyber-insurance reporting instructions, if applicable. Consult the appropriate advisers about customer or data notifications.
Prepare before the next suspicious message
Keep contacts and procedures somewhere accessible without the dispatch mailbox. Walk through a fictional delivery-change request with dispatch and billing. Make sure everyone knows when to pause, how to verify instructions, and whom to call—including after hours.
Related resources
Verify the safeguards behind your freight operation
After an incident is contained, the $1,995 Business Security Baseline can verify agreed evidence for businesses with up to 25 employees; larger teams receive a quote. It covers Microsoft 365 access, email protections, logging, and response readiness—not emergency containment or forensics.