Cyber-Enabled Cargo Theft: Why Carrier and Driver Identity Are Now Part of Cargo Security

Cyber-enabled cargo theft starts with a stolen login, a spoofed email, or a hijacked carrier identity and ends with real freight leaving with the wrong driver. The FBI, Verisk CargoNet, and the National Motor Freight Traffic Association (NMFTA) describe the same path. Carrier and driver identity are now part of the cargo security perimeter.

Criminals compromise or imitate trusted parties, then use the industry’s own tools and paperwork to win real loads. Many insurance programs were written for a time when cargo theft meant a stolen trailer, so coverage gaps may not surface until after a loss.

Key Takeaways

• Cyber-enabled cargo theft begins with identity and access, such as a stolen login or a spoofed carrier, and ends with a physical pickup.
• Verisk CargoNet estimated nearly $725 million in U.S. and Canada cargo theft losses in 2025, up 60% from 2024, with the average theft value up 36% to $273,990.
• Independent verification of carriers, drivers, and banking or destination changes stops schemes that technical controls alone miss.
• Insider involvement extends beyond employees to vendors, contractors, facility staff, and drivers. BSI and TT Club tied insiders to 22% of global cargo theft incidents.
• Whether a policy responds can depend on how the theft happened, including voluntary parting exclusions and document manipulation.

Cargo Theft Now Starts With Identity and Access

An April 2026 FBI public service announcement reports that threat actors have been gaining access to broker and carrier systems since at least 2024. They use spoofed emails, fake URLs, and compromised carrier accounts, then pose as the victim company and post fraudulent load-board listings. The FBI also describes fake carrier-broker agreement links and service-rating links that install legitimate remote monitoring and management (RMM) software, giving criminals hidden access.

In a November 2025 report, Proofpoint researchers assessed with high confidence that these threat actors are working with organized crime groups. Once inside a company’s systems, they bid on real shipments so the freight can be stolen and resold. NMFTA has described a common entry point: a phishing email linking to a lookalike of a popular load board, where stolen credentials let criminals post fake loads from legitimate accounts.

Phishing used to be easy to spot because of poor grammar and unfamiliar senders. Today’s messages use industry terms, executive names, and lookalike domains, and attackers are using AI to make them more convincing.

The loss data supports this shift. Verisk CargoNet’s 2025 year-end analysis recorded 3,594 supply chain crime events, nearly flat compared to 3,607 in 2024. Confirmed thefts, however, rose from 2,243 to 2,646, and estimated losses reached nearly $725 million. CargoNet’s first-quarter 2026 analysis found fewer total events but confirmed theft in 596 of 767 reports, with estimated losses of $131.58 million. It described impersonation-based theft as a systematic, scalable method.

That makes a company’s USDOT and MC numbers, load-board login, dispatch email, and transportation management system (TMS) potential tools for moving freight in its name. Changes to any of these should require more than one person’s approval.

How Verification and Access Controls Stop Fraudulent Loads

The Federal Motor Carrier Safety Administration (FMCSA) fraud and identity theft alert recommends confirming broker and carrier phone numbers through its SAFER system. If a number does not match, call the number listed in SAFER before proceeding. FMCSA also advises companies to treat their own company information like banking and credit card information. The FBI adds independent shipment verification, with the driver, vehicle, plate, cab, DOT and MC details, and communications documented.

Pressure is another tactic. Criminals search load boards for high-value freight and call a broker repeatedly, often posing as one or more carriers using stolen identities. Once they win the load, they resell it to an unsuspecting carrier or haul it themselves, and the freight is diverted to a cross-dock. The Transportation Intermediaries Association (TIA) State of Fraud in the Industry report found that 83% of respondents had experienced at least three types of fraud in six months.

Paperwork can be edited too. NMFTA cybersecurity principal engineer Ben Wilkens explained, “Using digital tools like a PDF editor, thieves can scan and edit bills of lading of loads in transit, then reprint and cover up missing cargo from delivery and facilitate undetected pilfering and short-delivery.”

The FBI also reports manipulated bills of lading and changed load destinations. A document that looks correct is not proof that the instructions are correct.

NMFTA’s Cybersecurity Cargo Crime Reduction Framework identifies insider threats and collusion as difficult to detect and defines them broadly to include employees, contractors, and trusted third parties misusing legitimate access. It recommends dual authorization for banking changes as a non-technical control. The BSI and TT Club 2025 Global Cargo Theft Report tied insider involvement to 22% of global cargo theft incidents.

Insiders can include employees acting on their own or manipulated by someone outside the company, as well as vendors, contractors, facility staff, and drivers. Strong controls protect the process without singling out any one group. A convincing caller, document, and login should still have to pass an independent check.

Why Many Cargo Insurance Policies Were Not Built for Cyber-Enabled Theft

Many cargo policy forms were written around a familiar scenario: freight is physically stolen from a trailer, yard, or vehicle. Cyber-enabled schemes often look different. The driver is deceived, the carrier follows the paperwork it was given, or the load goes to an identity that appeared legitimate.

Consignee impersonation shows the gap. Voluntary parting exclusions can remove coverage when cargo is handed over voluntarily, even when the driver was deceived. Some policy forms restore coverage through a carve-back endorsement. Others do not, and the wording varies.

Document manipulation raises a different question. If a bill of lading is altered before pickup and the motor carrier delivers exactly as directed, it is not always clear which coverage, if any, applies. The answer depends on the policy form and the facts.

Brokers face a similar problem. Contingent cargo coverage can respond to loss on freight the broker arranged, and some programs address theft by a carrier the broker hired through a strategic theft endorsement. Definitions, conditions, and limits vary, so the endorsement wording matters more than its name.

The same fraudulent load can also involve cyber, crime, and broker liability coverage, and those policies may point to each other. Policy language, contract obligations, and claim facts determine the outcome, so this is worth testing before a claim occurs.

Three Actions to Prevent Cyber-Enabled Cargo Theft

As Ben Wilkens noted, “The tools that are being used to facilitate these kinds of actions are the same tools that we can use to defend ourselves.”

• Verify identity through channels you control. Confirm carrier and broker phone numbers through SAFER, verify the driver, vehicle, plate, and DOT and MC details at pickup, and require a second approver for banking, contact, or destination changes. Check USDOT and MC records regularly for unauthorized changes. If misuse is found, FMCSA advises notifying insurers, load boards, and factoring companies.
• Close the remote-access door. Restrict installation of unapproved RMM tools, block executable files from outside email senders, and require phishing-resistant multifactor authentication (MFA) on load-board, TMS, dispatch email, and FMCSA accounts. Train staff to report suspicious messages quickly.
• Test a fraudulent load against your policies. Build one realistic scenario, such as a spoofed consignee or an altered bill of lading, and ask an insurance advisor which coverage responds, which exclusions or endorsements apply, and where the gaps are. Document the answer.

Treat Identity as a Cargo Control

Criminals in these schemes rely on an identity, a login, or a document that looks legitimate, and on a process that trusts it. Verification steps that hold up even when the caller, paperwork, and login all appear convincing are now a core part of cargo security.

Hylant’s transportation and logistics practice works exclusively within the industry, serving motor carriers, freight brokers, and warehouse operators, and works alongside Hylant’s cyber risk team to help transportation companies identify coverage gaps. To review your verification process and test your coverage against a cyber-enabled theft scenario, connect with a Hylant advisor.

The above information does not constitute advice. Always contact your insurance broker or trusted advisor for insurance-related questions.

Authored by

Mike Weber, Transportation Risk Consultant

Mike is a Transportation Risk Consultant in Hylant’s Fort Wayne office having been a former Area Executive with Yellow-Roadway. He holds the Transportation Risk Specialist (TRS) and Accredited Professional in Risk & Insurance (APRI) designations and advises motor carriers, freight brokers, 3PL's, and auto haulers on emerging risks, risk financing and transfer structure, and proactive claims strategy.