Sunday, November 8, 2026
The news that moves freight
Ocean Nov 8, 2026 · 7 min read

The stolen-load threat is now in the inbox, not the carrier file

Fewer fake carriers, more hijacked real ones: the Q3 theft data for anyone booking US trucks

Hijacked email accounts and spoofed phone lines were linked to 40.2% of stolen-load reports in Highway’s Q3 2026 Freight Fraud Index. FreightWaves reported the findings on 7 November. The index covers July to September. Highway is a carrier identity and fraud-prevention platform. Its numbers come from its own network, not the whole US market.

In the same quarter, thefts tied to sold authorities fell from 21.1% to 7.1% of the total. A “sold authority” is a trucking company’s federal operating number, often called an MC number, bought by someone who then uses its clean history to win loads.

Our view is simple. The threat has moved from fake carriers to real ones. Thieves no longer need to buy a clean-looking company. They take over the communications of a real one, or quietly take over the company itself. That means a carrier that passed your checks last month can still be the route to a stolen load today. Checks at onboarding are necessary. They are no longer enough.

What Highway found

The headline number fell. Highway counted 184 stolen-load reports in Q3, according to FreightWaves. That is down 28.1% from Q2, but up 8.2% on Q3 2025.

The mix is what matters. Beyond the 40.2% linked to compromised communications, FreightWaves reported these Highway figures:

  • Ownership-change reports came to 518, up 111.4% from Q2 and 12.4% year over year. These are reports that control of a carrier has passed to new people.
  • Unauthorized contact changes on carrier records at the FMCSA (Federal Motor Carrier Safety Administration, the US trucking regulator) came to 15,491, up 12.7% from Q2. Change the phone number and email on a carrier’s federal record, and brokers who look it up will call the thief.
  • Fraudulent or spoofed calls blocked by Highway rose 90.3% year over year.
  • Blocked fraudulent inbound emails came to 670,230, up 10.6% year over year.
  • 22,020 VINs (vehicle identification numbers) appeared on insurance certificates for more than one carrier. FreightWaves reported that one VIN appeared on certificates involving 15 different companies.
  • 5,336 identity documents were tied to more than one account.

Direct theft is the other growing slice. This is where a carrier accepts a real load and then simply does not deliver it. The number of these incidents fell 16% from Q2. But their share of stolen loads rose from 31.3% to 36.4%.

By pickup location, California had nearly half of the stolen-load incidents, followed by New Jersey and Texas.

Why “clean on paper” no longer helps

The quote that sums it up came from Alyssa Fleury, director of operations at PEI, a freight brokerage in Griffin, Georgia. She wrote, as quoted by FreightWaves: “A carrier can look great on paper, with established authority and a clean history.” Her point, as FreightWaves reported it, was that good credentials do not confirm who controls a carrier now. The people running it may not be the people who built that history.

That fits the shift Highway has been reporting all year. In its Q2 2026 release, published 28 July, Highway said communication-based attacks made up 50% of classified fraud vectors, up from 42.7% in Q1. That Q2 measure is not the same as the Q3 stolen-load share, so the two should not be compared directly. But the direction across three quarters is the same: the attack comes through the channel, not the paperwork.

Demi Ramon, Highway’s vice president of risk, said in that release: “Almost every successful theft starts with a bad actor exploiting your trust.” That trust is usually the trust between a broker and a carrier it has used before. A familiar name in the “from” line, or a familiar voice on a call, gets a load released faster. Thieves know that, and the Q3 data shows them using it.

Michael Caney, Highway’s chief commercial officer, put it this way in the Q2 release: “It’s not where is my freight, it’s who has it.”

Some volume measures did ease between quarters. Highway’s Q2 release reported 784,201 blocked fraudulent emails. The Q3 figure of 670,230 is about 14.5% lower on our arithmetic. We read that as a sign of a still very large volume of attempts rather than a retreat, since the Q3 number is still up 10.6% on last year.

The wider market: fewer thefts, bigger ones

Highway’s data is one network. Verisk CargoNet, which tracks US and Canadian cargo theft reports, published its Q3 2026 figures on 4 November. They point the same way.

CargoNet counted 547 incidents in Q3, down 33% year over year and down 19% from Q2. But estimated losses rose 12% to $230.1 million, from $205.1 million a year earlier. Year to date, the average stolen value is $448,456, up about 72% from $261,115. CargoNet logged 19 thefts worth $1 million or more in Q3, against 9 a year earlier.

Fictitious pickups also gained share. These are cases where a thief poses as the booked carrier and collects the freight. CargoNet counted 138 in Q3, against 147 a year earlier, but their share of incidents rose from 18% to roughly 25%.

California again led, with 182 incidents, about one-third of the total. Food and beverage was the most-stolen category, with 94 incidents.

Keith Lewis, vice president of operations at Verisk CargoNet, said criminals now “combine digital deception with traditional theft tactics”.

Put the two data sets together and the picture is clear. There are fewer thefts. They are better planned, more valuable, and more often run through someone pretending to be a carrier you trust.

The 87% figure needs care

Highway reported that 87% of direct-theft events involved carriers with at least one Highway user whose records included a non-domiciled or limited-term CDL designation. A non-domiciled CDL is a commercial driver’s licence issued by a US state to someone who does not live there permanently.

FreightWaves flagged the problem: Highway gave no network-wide baseline. Without knowing how common that marker is across all carriers, the 87% does not show these carriers are more likely to steal. Highway estimates that screening them out would cut available carrier capacity by about 7%.

Context matters here too. The FMCSA’s final rule on non-domiciled CDLs was issued in February 2026 and took effect on 16 March, according to Transport Topics. The agency projects that 194,000 current holders will leave the freight market. So this marker is shrinking anyway.

Our view: forwarders should not build a theft screen on this one figure. It risks cutting capacity on a statistic that has not been tested against a baseline. Contact checks at the point of release are a better use of effort.

What it means for forwarders

Most forwarders and NVOs (non-vessel-operating common carriers, which sell ocean space without owning ships) do not vet US truckers themselves. They book drayage (the short truck move from port or rail ramp) and truckload through brokers. That does not take the risk away. It moves it to the hand-off, where your team, your broker and the carrier all trade emails and calls.

Practical steps that follow from the data:

  • Confirm the carrier’s contact details at the moment of booking and again before release. Use a number you already hold, not the one in the latest email.
  • Treat any change of email domain, phone number or dispatcher as a stop sign until it is verified out of band.
  • Ask your brokers how they catch ownership changes and FMCSA contact edits. With ownership-change reports up 111.4% in a quarter, a broker that only checks at onboarding is behind.
  • Match the driver, truck and trailer at pickup to what was booked. Shared VINs across 22,020 certificates show why the paperwork alone can mislead.
  • Take extra care on loads picking up in California, New Jersey and Texas, and on food and beverage, which leads CargoNet’s theft table.

Highway itself expects holiday shipping demand to create more openings for thieves in Q4. FreightWaves also noted that tighter capacity could push brokers to skip steps. For forwarders, the run-up to Christmas is when time pressure and fraud pressure meet.

Our prediction

Our call: Highway’s Q4 2026 Freight Fraud Index, which we expect in late January or February 2027, will again link at least 40% of stolen-load reports to compromised communications. We also expect stolen-load reports to rise from Q3’s 184, driven by holiday volume. And we expect CargoNet’s full-year 2026 figures, due early next year, to show the average stolen value still above $400,000, even as incident counts finish the year lower than 2025.

If those calls hold, the lesson for 2027 is that the weak point is no longer the carrier file. It is the inbox, the phone line and the moment of release.

Sources

Read us on Google? Add Forwarder News as a preferred source to see more of our stories in Top Stories.