Compromised communications linked to 40% of stolen loads in Highway fraud report

A legitimate trucking company can have established operating authority, verified credentials and years of transportation history. But those records cannot guarantee that the person requesting freight actually controls the business. Criminals exploit trusted carrier identities to obtain shipments without immediately raising suspicion. Highway’s latest fraud findings document how compromised communications and ownership changes create opportunities for cargo theft.

Highway’s third-quarter Freight Fraud Index reveals how criminals targeted established carrier accounts between July and September 2026. Ownership change reports increased 111.4% from the previous quarter but rose 12.4% year over year. Meanwhile, fraudulent and spoofed calls blocked by the company increased 90.3% year over year. These findings highlight growing identity-related concerns across the freight network.

Despite these warning signs, Highway received fewer stolen load reports than during the previous quarter. The company recorded 184 incidents, representing a 28.1% quarterly decline. However, that figure remained 8.2% higher than the same period last year. Highway cautions that its findings reflect activity within its network, not nationwide cargo theft totals.

In written comments to FreightWaves, Highway attributed part of the decline to stronger verification procedures within its network. The company highlighted increased adoption of authenticated rate confirmations and additional identity checks before releasing shipment information. Those measures aim to prevent unauthorized individuals from accessing freight through compromised carrier accounts. However, Highway cautioned against crediting any single measure for the entire decline. Highway emphasized that brokers must verify the individual accessing shipment information, not just the carrier.

Criminals accessed carrier email accounts and used familiar addresses to request sensitive shipment information. Brokers encountered messages that appeared to originate from trusted transportation partners. Highway attributed 40.2% of its third-quarter stolen load reports to compromised communications. Unlike the second-quarter statistic covering fraud vectors, this figure measures the share of reported stolen shipments involving compromised communications.

The report identifies emailed rate confirmations as another vulnerability when criminals compromise carrier accounts. Unauthorized individuals can access shipment details through those inboxes. The risk extends beyond onboarding because criminals can gain access after brokers approve legitimate carriers. Its findings reinforce previous warnings about evolving freight fraud tactics.

Highway documented cases involving carriers that accepted legitimate shipments before stealing the freight themselves. Direct theft incidents declined 16% quarterly, but their share of reported stolen loads increased from 31.3% to 36.4%. The company previously examined the shift toward direct cargo theft involving established carrier identities. Some operators collected multiple loads within several days before brokers discovered the missing freight.

In its response to FreightWaves, Highway explained why these incidents present a particularly difficult verification challenge. The carriers involved may have established operating histories, legitimate equipment and trusted relationships with brokers. Their pickups can appear routine, making suspicious activity difficult to identify before the theft occurs. Unlike some other fraud methods, direct theft may offer fewer warning signs before a shipment disappears.

Real credentials, different people

Highway received 518 carrier ownership change reports during the third quarter. Its findings describe how criminals exploit established motor carrier authorities to obtain freight under recognizable company identities. A recent federal cargo theft case involving more than $12 million illustrates the potential consequences. Prosecutors allege conspirators took control of established trucking companies and impersonated previous owners to secure freight shipments.

Alyssa Fleury serves as director of operations at PEI, a freight brokerage based in Griffin, Georgia. She described the challenges brokers face when established carrier credentials no longer reflect who controls the business. Her team has encountered unauthorized carrier substitutions, suspicious communications and trucking companies operating under familiar authorities. Those situations require additional verification beyond the carrier’s operating history. Fleury emphasized that legitimate credentials alone cannot establish who will actually transport the freight.

“A carrier can look great on paper, with established authority and a clean history,” Fleury wrote. However, she cautioned that the individuals currently operating under that authority might differ from its previous owners. Her brokerage sometimes hires one carrier only to discover another trucking company arriving for pickup. Those discrepancies trigger additional checks of operating authority, insurance coverage and the relationship between the businesses. The distinction requires brokers to verify both the authorized contact and the company physically transporting the freight.

Highway reported that some buyers offered sellers money to falsely confirm that carrier ownership had not changed. These statements could conceal transfers involving established trucking authorities. Meanwhile, thefts associated with sold authorities declined from 21.1% to 7.1% of reported incidents. Highway says its ownership verification checks contributed to that decline.

Another finding raises questions about carrier identity verification and screening under legitimate trucking authorities. Highway reported that 87% of direct theft events involved carriers with a particular identity verification history. Those carriers had at least one Highway user whose records included a non-domiciled or limited-term CDL designation. The company measured this association across reported direct theft events during the preceding 90 days.

Asked how frequently the same verification history appears across its overall carrier network, Highway did not provide a percentage. The company confirmed that its Q3 Index lacks the network-wide comparison necessary to evaluate the finding. Without that baseline, the 87% figure cannot establish whether flagged histories occur disproportionately among carriers involved in direct theft. The association also does not establish that flagged users transported or stole the shipments.

Highway estimates that targeted non-domiciled and limited-term CDL screening reduces available carrier capacity by approximately 7%. The calculation assumes brokers configure restrictions for higher-risk states and a defined historical review period. The company recommends evaluating these settings against individual transportation networks. Its report does not quantify how many thefts the screening measures prevented.

FMCSA’s non-domiciled CDL rule took effect March 16, 2026. It limits eligibility for foreign-domiciled applicants to H-2A, H-2B and E-2 immigration classifications. Those licensing restrictions are separate from Highway’s fraud findings. The report does not establish that non-domiciled CDL holders are more likely to commit cargo theft.

Thousands of shared identities and vehicle records

Highway identified 22,020 vehicle identification numbers appearing on insurance certificates for multiple carriers. Among those records, 975 appeared across at least three authorities. Another 104 connected to five or more trucking businesses. One VIN appeared on certificates involving 15 different companies.

The report also identified 5,336 identity documents associated with multiple Highway user accounts. Of those, 746 connected to more than one carrier authority. Highway cautions that shared records do not automatically indicate fraudulent activity. Equipment leasing, affiliated businesses and clerical errors can produce legitimate overlaps.

Geographically, California remained the leading pickup location for stolen loads reported to Highway. The state accounted for nearly half of the company’s third-quarter incidents. New Jersey ranked second, followed by Texas. General merchandise, electronics and bulk commodities represented the most frequently targeted freight categories.

Highway identified Colombia, India and the Philippines as the leading recorded origins of blocked foreign sign-in attempts. Its systems flag suspicious access originating outside a user’s home country. However, criminals can disguise their internet connection locations through technical methods. The recorded country therefore does not necessarily identify where an individual physically operated.

Highway also blocked 670,230 fraudulent inbound emails during the quarter. That figure represented a 10.6% increase compared with the previous year. Unauthorized FMCSA contact changes reached 15,491, climbing 12.7% from the second quarter. These indicators demonstrate the volume of suspicious activity the company’s systems encountered.

Highway expects holiday shipping demand to create additional opportunities for cargo thieves during the fourth quarter. Tighter capacity could increase pressure on brokers to bypass established verification procedures. The company recommends confirming authorized carrier contacts, checking driver information and documenting exceptions before releasing shipments. Its findings emphasize maintaining those safeguards during urgent bookings, including nights and weekends.

Why it matters

Legitimate operating authorities and established carrier relationships cannot independently establish who controls a shipment. Freight brokers must verify the individuals requesting freight before granting access to sensitive information or releasing cargo.

In my opinion, Highway’s findings reinforce a critical lesson: Fraud prevention cannot stop at carrier onboarding. The Certified Fraud Compliance Officer (CFCO) program teaches transportation professionals to verify identities, investigate suspicious activity and make consistent decisions. Technology can identify warning signs, but trained employees must know how to respond. The most expensive mistake is often the one your team was never trained to recognize.

Source: FreightWaves