From breaking locks to stealing trust
Traditional cargo theft has long exploited physical opportunity: loaded trailers parked overnight, weak yards, vulnerable seals or trucks followed from distribution centers. Those risks remain, but 2026 has highlighted a growing layer of strategic theft built around carrier impersonation, fictitious pickup and shipment misdirection. Criminals do not need to cut a lock if they can convince a warehouse that they are the carrier of record.
Verisk CargoNet recorded 767 supply-chain crime events across the United States and Canada in Q1 2026, with estimated losses of USD 131.58 million. It said organized groups increasingly impersonated legitimate carriers and brokers, using phishing, remote-access trojans and credential harvesting to compromise business email, internet-based phone systems and applications used to source freight or verify counterparties.
In Q2, reported events fell to 677, yet estimated losses climbed to USD 304.6 million, more than double Q2 2025. Fictitious pickup incidents declined only slightly, from 165 to 158. CargoNet identified business email compromise as a primary entry point because one compromised account can expose shipment details, contacts and operating systems, allowing criminals to redirect freight while appearing legitimate.
TT Club's 2025 claims analysis found fraudulent carrier activity in 32% of the cargo-theft claims it reviewed, while 14% involved suspected internal participation. TAPA EMEA reported 58,661 cargo-crime incidents across 101 countries in the 18 months to 30 June 2026; only 7.8% included financial data, yet the reported losses already exceeded EUR 1 billion.
One compromised identity can open the entire shipment lifecycle
The defining danger of identity-based cargo crime is that valid credentials can pass controls designed to filter out obviously fake companies. CargoNet has observed criminals moving beyond lookalike emails and bogus websites to compromising software-based business phone systems, gaining access to carrier accounts on compliance platforms, or persuading legitimate employees to add them as authorized users.
Another tactic is the acquisition of an existing motor carrier with active authority and a legitimate operating history. On a broker's screen, the company may still show valid registration, insurance and years of normal activity. What has changed is the party controlling the business. Verification that asks only “Does this company exist?” can miss the more important question: “Who is operating it today?”
The attack can continue from tender through post-pickup. Criminals may compromise a broker or carrier account, accept the load, hire a legitimate driver to make the physical pickup with correct reference numbers, and then redirect the shipment. In another variation, a real carrier takes possession but a compromised email or phone system later sends new delivery instructions. Controls that end when the tender is awarded cannot protect the full shipment lifecycle.
Digital deception and physical execution blur responsibility. The driver may be innocent, the warehouse may have followed its documented process, the carrier in the database may be real and the truck may have valid plates. Criminals exploit the seams between organizations: the broker trusts the carrier, the shipper trusts the broker, the warehouse trusts the pickup code and the receiver trusts the instruction.
|
Cargo security in the digital-identity era must protect both the physical asset and the authority to act on behalf of a trusted party. A real carrier does not guarantee that the person using its email, phone number or compliance account is legitimate. Verification therefore has to continue from tender through dispatch, pickup, destination changes and delivery. A sudden change in driver, vehicle, phone number, delivery address or post-pickup instruction should be treated as a security event, not merely an operational update. |
The new security model requires continuous verification from tender to delivery
The first layer of defense is to separate company vetting from transaction-level identity verification. FMCSA advises brokers and carriers to confirm phone numbers against official records rather than rely on emailed contact details, examine documents carefully, and confirm tractor, trailer and driver information at pickup. The broader principle is that the verification source should be independent from the channel that may have been compromised.
Second, organizations need step-up verification for high-risk changes. A post-pickup destination change, last-minute driver substitution, carrier change, bank-account change or unusual “blind load” instruction should not be handled like routine email traffic. Controls can include callback to a pre-existing contact, MFA, one-time codes, driver and vehicle validation at the dock, and dual authorization before critical instructions are changed.
Third, security should become part of the logistics control tower. GPS, geofencing, route deviation, dwell time, gate cameras, proof of pickup and proof of delivery should be analyzed as one operational stream. A verified truck that immediately deviates from route, or a shipment suddenly redirected to an unfamiliar warehouse, should trigger an alert. Identity verification and shipment visibility need to converge.
Fourth, internal access must be controlled. TT Club's data on suspected insider involvement is a reminder that the person who knows which shipment is worth stealing can be as important as the person outside the gate. Need-to-know access, controls on exporting high-value shipment lists, access logging and alerts for unusual downloads are supply-chain security measures, not merely IT hygiene.
For Vietnamese logistics companies, the lesson is to build verification before fictitious-carrier fraud becomes widespread locally. As digital booking, e-documents, freight marketplaces and APIs expand, digital identity becomes part of chain of custody. Shippers, forwarders, 3PLs and warehouses need shared rules defining who can change pickup, delivery, bank details or contacts, through which channel, and what evidence is required.
AI can help flag unusual domains, behavioral patterns, routes and network relationships, but it is not a perfect automated fraud detector. Criminal groups adapt to controls. CargoNet has noted that effective anti-fraud tools are pushing organized groups toward more elaborate schemes. The durable objective is therefore to design processes in which one stolen credential cannot unlock the entire shipment.
Cargo crime is entering a phase in which trust itself becomes a target. When criminals can call from a verified number, send messages from a genuine account or operate under legitimate authority, the question “Is the record valid?” is no longer sufficient.
A secure supply chain now has to answer harder questions: who is behind this identity, are they authorized to perform this action at this moment, and is the physical shipment moving consistently with the verified digital identity? Only when physical security and digital identity security converge can cargo theft be stopped before the freight leaves the warehouse door.
