FBI Warns of Freight-Broker Impersonation: Verify the Load Before Cargo Moves
The FBI’s April 2026 warning describes criminals impersonating logistics businesses to redirect high-value shipments. A fast callback and independent carrier checks matter more than a familiar email or polished load sheet.
A dispatcher sees a load from a familiar broker. The rate looks plausible, the pickup window is tight, and the email thread contains the right company name. A carrier accepts. Later, the shipper calls to ask why the delivery address changed—or why a truck arrived that nobody at the company recognizes.
On April 30, 2026, the FBI’s Internet Crime Complaint Center warned that criminals were impersonating brokers and carriers to hijack freight and reroute high-value shipments. The alert says attackers may exploit compromised accounts, spoofed emails, fake web addresses, and fabricated onboarding details. It cites estimated cargo theft losses of nearly $725 million across the United States and Canada in 2025. That is an estimate cited by the FBI, not a measure of every loss or a prediction for every shipment.
For a live load: do not rely on a name, email thread, PDF, DOT number, or caller ID alone. Independently call a previously verified contact, confirm both pickup and delivery details, check the company’s legal name and authority through official FMCSA records, and require a second approval for any last-minute change. If a driver, vehicle, carrier, or destination does not match the verified plan, pause the release and escalate.
Why a normal-looking load can still be unsafe
Logistics depends on fast coordination among shippers, brokers, carriers, dispatchers, drivers, warehouses, and insurers. A single shipment may involve several companies and several communication channels. That is useful for keeping goods moving, but it also creates moments when one party cannot easily tell whether an instruction came from the real person who controls the load.
The FBI’s 2026 alert describes schemes where criminals impersonate a legitimate business or abuse an account that appears to belong to one. A document can be formatted correctly; a familiar contact can send a message from a mailbox that is no longer under the company’s control; and a real carrier’s identifying information can be misused. Official records help check a company’s identity and authority, but records alone do not prove that the person currently messaging you controls that company or this shipment.
The threat can appear at different moments: when a load is offered, when a new carrier is onboarded, when a driver is dispatched, or after a destination or contact detail changes. The most important safeguard is to verify the specific transaction through more than one channel before the cargo is released.
| Moment | What to verify independently | Pause if… |
|---|---|---|
| New load or broker contact | Legal company name, known phone number, load reference, and who authorized the offer. | The only contact path is a new email, a short link, or a number in the message. |
| Carrier onboarding | Carrier identity and operating authority in official FMCSA records; established references. | Banking, insurance, or contact details changed without prior confirmation. |
| Pickup appointment | Driver name, expected tractor/trailer identifiers, pickup number, and warehouse instructions. | The driver or truck differs from the dispatch record and no verified contact can explain it. |
| Delivery or reroute | Destination, recipient, release authority, and the person requesting the change. | A last-minute instruction arrives only by email or a caller pressures staff to skip a callback. |
A practical pre-release check for shippers and brokers
- Confirm the load against a known record. Match the rate confirmation, shipper’s order, load reference, pickup appointment, and delivery address. A change to one field should not silently overwrite the rest of the documentation.
- Call a trusted number—not the number in the change request. Use the phone number in an established vendor record or a contract created before the current offer. Ask the original contact to confirm the load, carrier, driver, and both addresses.
- Check the company through official FMCSA tools. SAFER provides a free Company Snapshot for motor-carrier identification and safety data. FMCSA’s Licensing and Insurance resources show authority and insurance information. Compare the legal name, identifiers, operating status, and contact information; do not treat a search result or screenshot as a substitute.
- Validate the person and shipment together. A real company record is not enough if an unknown person is asking to take a specific load. Call a known broker or carrier contact and confirm that the person is authorized for this transaction.
- Use dual control on exceptions. Require another staff member to approve a new carrier, new bank detail, driver substitution, or destination change. The second person should verify through their own known route, rather than merely approving the first person’s screenshot.
Official databases can be useful but have limits. A legitimate business’s information can be copied, and a record may not show every recent operational change immediately. FMCSA says Company Snapshot data is updated daily except certain inspection and crash counts, which are updated weekly. A match in SAFER is one verification layer, not proof that a particular email or pickup instruction is genuine.
For carriers and dispatch teams
Be careful with unexpected links to review a service complaint, sign a broker agreement, or open a revised load board. The FBI has warned that fake web addresses and account compromise can be part of cargo-theft schemes. If an unfamiliar form asks you to install an application, grant remote access, or enter a load-board password, stop and contact the broker through a previously saved channel.
Protect dispatch and load-board accounts with unique passwords and multifactor authentication where available. Limit who can add users, change contact information, or post loads. Review account activity and mailbox forwarding rules if a staff member reports an unexpected login prompt or suspicious “review” link. If a business account may be compromised, tell the broker or carrier network quickly so it can pause unauthorized dispatches.
For a driver, the key is not to accuse a customer at the dock. The driver should follow the carrier’s dispatch protocol, confirm discrepancies with dispatch using the established company number, and avoid accepting a new destination from an unverified person. Keep the bill of lading and pickup instructions intact. If staff cannot verify the change, hold the load safely and escalate rather than improvising.
When a pickup detail changes at the last minute
Last-minute operational changes do happen: a warehouse can move a dock, a receiver can close early, or weather can disrupt a route. A legitimate change should still be confirmed. Contact both the party requesting the change and the party responsible for receiving the shipment, using phone numbers already on file. Confirm who bears authority to approve it and record the decision in the dispatch system.
Do not accept “the old contact is unavailable” as proof that the new one is authorized. Do not let someone change the destination by sending a new PDF without a phone confirmation. A scanned signature or company logo can be copied; compare it against the actual order, and call a known contact to verify the update.
This is similar to an invoice diversion scam: the expected document may look routine while one critical destination changes. Our guide to supplier payment instructions that suddenly change explains the same independent-callback principle for money movement.
If the cargo may already be diverted
Contact the shipper, broker, carrier, warehouse, and law enforcement using verified contact details. Ask the carrier’s dispatch team to locate the driver and confirm the last known route; do not rely only on a number supplied in the suspicious message. Preserve bills of lading, load-board records, emails, call logs, photographs, license plate and trailer details, pickup times, and any altered paperwork. Restrict access to the incident record to people who need it.
Notify the relevant insurer and follow its reporting requirements. The FBI recommends reporting a suspected strategic cargo theft to local police and to IC3. If a business account was compromised, also secure credentials, revoke unknown sessions, and alert business partners that may receive fraudulent loads under your company’s name. Avoid making public accusations against a driver or carrier before the facts are verified; legitimate participants can also be deceived.
IC3 reporting is not a recovery guarantee. It gives investigators details that may help connect a shipment to other cases. A timely report should include the company names, identifiers, communications, payment or cargo loss information, and the shipment timeline.
Build a verification habit, not a longer form
Adding more fields to an onboarding packet does not solve impersonation if every field comes from the same unverified source. A better routine asks, “Which independent route confirms this specific load?” Keep a trusted contact list, use a callback on every material change, require a second approver for exceptions, and make it acceptable for staff to pause a load when details do not align.
Teach teams that familiar names and email addresses can be misleading. A shipping instruction should be supported by independent confirmation, not only by a polished email. The few minutes spent verifying pickup and delivery can protect the cargo, the carrier, the broker relationship, and the reputation of a legitimate company whose identity may be copied.
Sources and further reading
- FBI IC3 (April 30, 2026): Cyber-Enabled Strategic Cargo Theft Surging — current warning, indicators, and recommendations for shippers, brokers, and carriers.
- FMCSA SAFER: Company Snapshot — explains the free public carrier snapshot.
- FMCSA SAFER FAQ — explains data freshness and system sources.
- FMCSA: Insurance filing requirements — describes operating authority and insurance filings by entity type.
Found a factual error or a source that has changed?
Send a correction →
