Compromised Carrier Emails Tied to 40% of Stolen Loads in Q3 2026

How do criminals steal loads using a legitimate carrier's email account?

Criminals accessed carrier email accounts and used familiar addresses to request sensitive shipment information from brokers. Highway attributed 40.2% of its third-quarter stolen load reports to compromised communications. The company recorded 184 stolen load incidents between July and September 2026, down 28.1% from the previous quarter but still 8.2% higher than the same period last year.

Brokers encountered messages that appeared to originate from trusted transportation partners. The emails came from real carrier addresses, making the requests look routine. Once criminals gained access to a carrier's inbox, they could see emailed rate confirmations and shipment details. The risk extends beyond initial onboarding because criminals can compromise accounts after brokers approve legitimate carriers.

Ownership-change reports surged 111% in one quarter

Highway received 518 carrier ownership change reports during the third quarter, a 111.4% increase from the previous quarter and 12.4% higher year over year. The company's findings describe how criminals exploit established motor carrier authorities to obtain freight under recognizable company identities.

A recent federal cargo theft case involving more than $12 million illustrates the potential consequences. Prosecutors allege conspirators took control of established trucking companies and impersonated previous owners to secure freight shipments. Highway reported that some buyers offered sellers money to falsely confirm that carrier ownership had not changed. These statements could conceal transfers involving established trucking authorities.

Alyssa Fleury, director of operations at PEI, a freight brokerage based in Griffin, Georgia, described the challenges brokers face when established carrier credentials no longer reflect who controls the business. "A carrier can look great on paper, with established authority and a clean history," Fleury wrote. However, she cautioned that the individuals currently operating under that authority might differ from its previous owners.

Her brokerage sometimes hires one carrier only to discover another trucking company arriving for pickup. Those discrepancies trigger additional checks of operating authority, insurance coverage and the relationship between the businesses. The distinction requires brokers to verify both the authorized contact and the company physically transporting the freight.

Direct theft by legitimate carriers accounted for 36% of incidents

Highway documented cases involving carriers that accepted legitimate shipments before stealing the freight themselves. Direct theft incidents declined 16% quarterly, but their share of reported stolen loads increased from 31.3% to 36.4%. Some operators collected multiple loads within several days before brokers discovered the missing freight.

In its response to FreightWaves, Highway explained why these incidents present a particularly difficult verification challenge. The carriers involved may have established operating histories, legitimate equipment and trusted relationships with brokers. Their pickups can appear routine, making suspicious activity difficult to identify before the theft occurs. Unlike some other fraud methods, direct theft may offer fewer warning signs before a shipment disappears.

Highway reported that 87% of direct theft events involved carriers with at least one Highway user whose records included a non-domiciled or limited-term CDL designation. The company measured this association across reported direct theft events during the preceding 90 days. However, Highway did not provide a percentage showing how frequently the same verification history appears across its overall carrier network. Without that baseline, the 87% figure cannot establish whether flagged histories occur disproportionately among carriers involved in direct theft.

FMCSA's non-domiciled CDL rule took effect March 16, 2026. It limits eligibility for foreign-domiciled applicants to H-2A, H-2B and E-2 immigration classifications. Those licensing restrictions are separate from Highway's fraud findings. The report does not establish that non-domiciled CDL holders are more likely to commit cargo theft.

Fraudulent calls blocked by Highway jumped 90% year over year

Fraudulent and spoofed calls blocked by the company increased 90.3% year over year. Highway also blocked 670,230 fraudulent inbound emails during the quarter, a 10.6% increase compared with the previous year. Unauthorized FMCSA contact changes reached 15,491, climbing 12.7% from the second quarter.

Highway identified Colombia, India and the Philippines as the leading recorded origins of blocked foreign sign-in attempts. Its systems flag suspicious access originating outside a user's home country. However, criminals can disguise their internet connection locations through technical methods. The recorded country therefore does not necessarily identify where an individual physically operated.

Shared equipment and identity documents raise red flags

Highway identified 22,020 vehicle identification numbers appearing on insurance certificates for multiple carriers. Among those records, 975 appeared across at least three authorities. Another 104 connected to five or more trucking businesses. One VIN appeared on certificates involving 15 different companies.

The report also identified 5,336 identity documents associated with multiple Highway user accounts. Of those, 746 connected to more than one carrier authority. Highway cautions that shared records do not automatically indicate fraudulent activity. Equipment leasing, affiliated businesses and clerical errors can produce legitimate overlaps.

California accounted for nearly half of stolen loads

Geographically, California remained the leading pickup location for stolen loads reported to Highway. The state accounted for nearly half of the company's third-quarter incidents. New Jersey ranked second, followed by Texas. General merchandise, electronics and bulk commodities represented the most frequently targeted freight categories.

What brokers should verify before releasing a shipment

Highway expects holiday shipping demand to create additional opportunities for cargo thieves during the fourth quarter. Tighter capacity could increase pressure on brokers to bypass established verification procedures. The company recommends confirming authorized carrier contacts, checking driver information and documenting exceptions before releasing shipments.

In written comments to FreightWaves, Highway attributed part of the decline in stolen loads to stronger verification procedures within its network. The company highlighted increased adoption of authenticated rate confirmations and additional identity checks before releasing shipment information. Those measures aim to prevent unauthorized individuals from accessing freight through compromised carrier accounts.

However, Highway cautioned against crediting any single measure for the entire decline. Highway emphasized that brokers must verify the individual accessing shipment information, not just the carrier. Legitimate operating authorities and established carrier relationships cannot independently establish who controls a shipment. Freight brokers must verify the individuals requesting freight before granting access to sensitive information or releasing cargo.

Brokers running digital carrier packets should add a step to confirm the authorized contact matches the person requesting the load, especially when ownership-change reports are climbing triple digits quarter over quarter.