Cyber cargo theft is when criminals break into a carrier's or broker's email and online accounts, then use that access to book, re-broker or redirect real loads. The FBI has publicly warned that these schemes, active since at least 2024, often start with a phishing email that installs remote-access software. From there the thieves act as the company they hacked.

What did the FBI warn carriers and brokers about?

The FBI issued a public service announcement titled "Cyber-Enabled Strategic Cargo Theft Surging." It describes criminals posing as freight brokers, tricking carriers into clicking links, taking over their accounts, and then booking and diverting real freight under the carrier's name. It also says they change the carrier's contact and insurance information with FMCSA.

The FBI lays the scheme out in four steps:

  1. The bait. The criminals pose as brokers and send emails with shortened or spoofed links, often about a carrier agreement or a bad service rating. The link leads to a fake site that installs malware, which then installs legitimate remote-access software.
  2. The fake loads. Using the hacked carrier's accounts, they post fake loads on load boards, sometimes tens of thousands of them. Carriers who bid get sent a malicious carrier-broker agreement, and the cycle repeats.
  3. The real loads. Posing as the hacked carrier, they book real freight and double broker it. They alter bills of lading, change delivery destinations, and change the carrier's contact and insurance details with FMCSA.
  4. The diversion. The freight is cross-docked or moved onto another truck with a complicit driver. In some cases the criminals demand a ransom from the broker to reveal where the load is.

How does a phishing email turn into a stolen load?

One click gives the thieves your inbox, and your inbox is your company's identity. Once they can read and send your email, they can answer brokers as you, accept loads as you, and change where the money and the freight go. Because the email really comes from your account, the usual checks pass.

That is why this kind of theft gets around ordinary vetting. The MC number is real, the insurance is real, the email address is real. Only the person behind the keyboard is wrong. FMCSA makes the same point in its fraud guidance: the real company may be a victim too.

What are the warning signs of cyber cargo theft?

The clearest warning sign is hearing about loads booked in your name that you never booked. Others are lookalike email domains, unexpected links about agreements or ratings, and mailbox rules you didn't create. The FBI lists these signs that a company's accounts or identity are being used:

  • Calls or emails about loads booked in your name that you never booked
  • Free email accounts made to look like your company's domain
  • Shortened or spoofed download links in emails about agreements or ratings
  • Emails about a "negative review" you need to "resolve"
  • New rules in your mailbox you didn't create, such as forwarding, auto-delete or hidden folders
  • Lookalike website domains
  • A job title added in front of a real email address to make it look official
  • Phone numbers that are internet-based, short-lived, app-based or overseas

Can a familiar voice on the phone be faked?

Yes. The FBI has warned that criminals use AI-generated voice cloning to sound like a person you know, and that these voices can be very hard to tell from the real thing. In freight, a call that sounds like a dispatcher or broker you work with is not proof of who is calling. Hang up and call back on a number you already had.

The FBI suggests agreeing on a secret word or phrase with the people you deal with regularly, and never giving out a sign-in code over the phone.

How do carriers and brokers stop cyber cargo theft?

The FBI's main advice is to verify through a second channel before anything moves. If a request comes by email, confirm it by phone on a number you already had, and the other way around. Don't trust a familiar name or email address on its own. Use two-step sign-in on email, load board and registration accounts.

Other habits that help:

  • Don't open agreements, rating notices or "documents" from links you weren't expecting.
  • Check your mailbox rules every so often for forwarding or auto-delete rules you didn't set.
  • Look up your own company on FMCSA's SAFER system regularly to make sure your contact details are still yours.
  • Document every pickup. The FBI recommends photos of the driver, their license, the truck and trailer, the plates and unit numbers, and the DOT and MC numbers on the door.
Shipping clerk photographing the truck and trailer at the dock before releasing a load
The FBI recommends photographing the driver, truck, trailer and plates at pickup.

What should a carrier do if its accounts were hacked?

Act fast and assume the thieves are still inside. Remove any remote-access software you didn't install, change your email and account passwords from a clean device, turn on two-step sign-in, and delete mailbox rules you didn't create. Then check and correct your contact details with FMCSA, and warn the brokers and load boards you work with.

Report it:

  • FBI: ic3.gov or your local FBI field office
  • Local police: file a report, especially if freight was taken
  • FMCSA: the Complaint Center and the Contact Center at 1-800-832-5660
  • Your insurer, factoring company and load boards

For the bigger picture, see our cargo theft statistics and how double brokering differs from co-brokering. Our article on what to do if someone is using your MC number walks through the identity side step by step. If you were left unpaid or caught in a dispute over a diverted load, file a free complaint and we'll review the evidence and contact the broker named in it.

For help with your FMCSA registration and account security, Logistical Forwarding Solutions works with small carriers on DOT compliance. If a case turns into a legal matter, the National Transportation Attorney Network lists transportation attorneys by state.