Criminals Stole $31.8M in Freight by Hijacking Carrier Accounts Over Five Labor Days
CargoNet tracked 273 cargo thefts across five Labor Day weekends. Fraudsters changed delivery instructions after legitimate carriers picked up loads, bypassing broker vetting.
Criminals stole approximately $31.8 million in freight across five Labor Day weekends by compromising carrier accounts and changing delivery instructions after legitimate trucking companies took possession of loads. Verisk CargoNet tracked 273 incidents from 2021 through 2025 in a report released Friday.
How do criminals bypass broker vetting to steal freight?
They enter trusted freight channels through compromised carrier accounts, email systems, business phones or compliance platforms. After a legitimate trucking company picks up a load, criminals change the delivery instructions. That move bypasses safeguards focused only on carrier selection at the time of dispatch.
CargoNet identifies this identity-based deception as an expanding holiday threat. The pattern differs from fictitious pickups where a fake carrier shows up at the shipper. In these cases, the real carrier takes possession, then someone with access to that carrier's systems redirects the freight.
Friday saw the most thefts, but the holiday weekend dropped off
Friday led every weekday with 55 incidents. Tuesday followed with 49, Thursday produced 46, and Wednesday recorded 44. Those four days generated 194 cases, representing 71% of the five-year total.
The holiday weekend produced significantly fewer reports. Saturday accounted for 24 incidents, Sunday had 28, and Labor Day Monday recorded 27. CargoNet connected this pattern with deceptive pickups and non-delivery schemes. Those crimes depend upon active phone lines, working employees, and freight moving through normal channels. Such conditions decline during closures.
Theft volume jumped 70% from 2021 to 2025
The annual count increased from 33 incidents in 2021 to 56 during 2025, a 70% jump. Activity reached a five-year high with 70 cases in 2024. Risk remained materially above levels recorded early in the period.
CargoNet described two overlapping risks surrounding the holiday. Physical exposure develops when loaded freight remains stationary during closures or schedule disruptions. Verification exposure emerges when limited staffing combines with time pressure. Those conditions help criminals impersonate carriers, alter instructions, or introduce fraudulent contact information.
California, Texas, and Illinois accounted for nearly half of all thefts
California, Texas, and Illinois accounted for 130 incidents, representing 48% of the five-year total. California led the country with 70 cases. Texas followed at 38, while Illinois recorded 22. Verisk connected this concentration with dense freight networks, large consumer markets, and intermodal infrastructure.
Food and beverage shipments led all commodity categories with 49 incidents. Household goods ranked second with 27, followed by electronics at 25. Vehicles and accessories accounted for 20 cases, while metals produced 11. CargoNet noted that these products offer strong resale opportunities through numerous illicit channels.
Cargo theft losses exceeded $359 million in the first half of 2026
The broader financial threat extends beyond Labor Day. CargoNet estimated cargo theft losses exceeded $359 million during 2026's first six months. Average stolen commodity value reached approximately $341,518. Organized groups increasingly pursue expensive metals, enterprise technology components, and other high-value freight.
Verisk did not identify individual victims, suspects, carriers, or investigations within the Labor Day analysis. The report provided no breakdown separating physical thefts from identity-based schemes. CargoNet also withheld individual loss amounts and recovery outcomes.
What brokers and carriers should verify before and during holiday weekends
Brokers face exposure before, during, and after holiday weekends. The findings show that routine business activity can give criminals more opportunities than complete closures. Verification steps should include confirming delivery instructions through multiple channels when a carrier requests changes, especially on Fridays and the days immediately before a holiday. Limited staffing during holiday periods creates the time pressure criminals exploit to push through fraudulent instruction changes.
Carriers should lock down account access and monitor for unauthorized login attempts during holiday periods. If your email, phone system, or compliance platform credentials are compromised, criminals can redirect loads you legitimately picked up without the broker knowing the instructions came from an impostor.
