In the modern freight landscape, the "paper trail" has become a deceptive weapon. For decades, brokers and shippers have relied on established motor carrier authorities, verified insurance credentials, and long-standing transportation histories as the gold standard for vetting partners. However, as the latest data from the Highway Q3 2026 Freight Fraud Index makes clear, these metrics are no longer a guarantee of security. Today, criminals are not just breaking into the supply chain; they are effectively "becoming" the supply chain by hijacking the digital and legal identities of trusted carriers.
The findings from Highway’s third-quarter report paint a sobering picture of an industry under siege. While traditional cargo theft often involved physical hijacking or brute-force tactics, the contemporary threat is rooted in identity manipulation, compromised communications, and the illicit acquisition of dormant or active carrier authorities. As the freight network grows more complex, the gap between "looking legitimate on paper" and "being a legitimate operator" has widened into a chasm that thieves are exploiting with increasing precision.
The Evolution of Freight Fraud: A Chronological Overview
The third quarter of 2026 served as a microcosm of the systemic challenges facing the logistics sector. Between July and September, Highway’s monitoring systems tracked a series of alarming trends that indicate a shift toward more patient, calculated theft.
Historically, freight fraud was characterized by "fictitious pickups"—criminals creating temporary, fake identities to secure a load and vanish. The new reality is far more insidious. Criminals are now targeting established carrier accounts, gaining access to internal email systems, and intercepting rate confirmations. By the time a broker realizes they are speaking to an imposter, the load has already been tendered, picked up, and diverted.
According to the report, ownership change notifications—a key indicator of potential account takeovers—surged by 111.4% compared to the previous quarter. While this reflects a 12.4% rise year-over-year, the sharp quarterly spike suggests that bad actors are aggressively attempting to restructure or rebrand hijacked authorities to evade detection. Simultaneously, the volume of fraudulent and spoofed calls blocked by Highway’s network jumped by 90.3% year-over-year, underscoring the relentless nature of these social engineering campaigns.
Supporting Data: The Anatomy of a Compromised Network
While the volume of suspicious activity is rising, Highway reported a 28.1% quarterly decline in the number of actual stolen load reports (184 total incidents). While this news is encouraging, it must be viewed with caution: the figure remains 8.2% higher than the same period in 2025. Highway is careful to emphasize that these figures represent only the activity within its own network, not a comprehensive tally of nationwide cargo theft.
The data reveals specific vulnerabilities that have become common entry points for thieves:
- Compromised Communications: A staggering 40.2% of reported stolen loads in Q3 involved compromised carrier communications. Criminals are accessing legitimate email inboxes to send fake rate confirmations that appear to come from trusted partners, effectively inserting themselves into the middle of the broker-carrier workflow.
- The "Direct Theft" Phenomenon: Perhaps the most disturbing trend is the rise of direct theft by established carriers. While the total number of these incidents declined by 16% quarterly, their proportion of total reported thefts rose from 31.3% to 36.4%. These are not "fake" companies; these are real carriers with real equipment who accept legitimate loads and then steal them.
- Shared Credentials: Highway’s analysis of 22,020 vehicle identification numbers (VINs) found that 975 were associated with three or more distinct carrier authorities, and one VIN was linked to 15 different companies. While equipment leasing and legitimate business affiliations can explain some of this, the data points to a massive, porous web of shared assets that obscures accountability.
Official Responses and Verification Strategies
In written responses to FreightWaves, Highway attributed the quarterly decline in stolen loads to a "defense-in-depth" approach. The company highlighted the widespread adoption of authenticated rate confirmations and more rigorous identity-check protocols before any shipment data is released.
However, the company was quick to temper optimism, warning that no single "silver bullet" can solve the crisis. "Brokers must verify the individual accessing the shipment information, not just the carrier," a representative noted. This distinction is vital. As the digital identities of companies are increasingly compromised, the burden of proof has shifted to the human element.
This sentiment was echoed by industry practitioners like Alyssa Fleury, director of operations at PEI in Griffin, Georgia. For Fleury, the challenge is that a carrier can appear pristine on paper while being under entirely new, unauthorized management. "We sometimes hire a carrier, only to have a completely different trucking company show up for the pickup," Fleury explained. "These discrepancies require an immediate halt to the process and a secondary verification of insurance, operating authority, and the specific individuals involved."
The Non-Domiciled CDL Controversy
One of the most debated findings in the Highway report relates to the correlation between theft events and specific verification histories. Highway noted that 87% of direct theft events involved carriers with at least one user account associated with a non-domiciled or limited-term CDL.
While this figure is striking, it comes with a critical caveat: Highway lacks a network-wide baseline. Without knowing how many legitimate, non-theft-involved carriers also hold these types of credentials, it is impossible to statistically determine if this is a high-risk indicator or merely a demographic reflection of the broader driver pool. Highway clarified that the report does not suggest that holders of non-domiciled CDLs are inherently prone to theft; rather, it highlights a specific data point that, when combined with other indicators, may help flag high-risk transactions.
Geographical and Tactical Trends
Geographically, the threat remains concentrated in traditional logistics hubs. California led the country in reported stolen load pickups, accounting for nearly half of all incidents. New Jersey and Texas followed, maintaining their positions as high-risk zones.
The tactics employed by these groups are increasingly global in scope. Highway identified Colombia, India, and the Philippines as the primary origins of blocked foreign sign-in attempts. While criminals often use VPNs and proxy servers to disguise their true locations, the sheer volume of these attempts—over 670,000 blocked emails in a single quarter—demonstrates the industrial scale of the fraud operations currently targeting the U.S. supply chain.
Implications for the Future: Why It Matters
As the industry heads into the Q4 holiday shipping season, the pressure to move freight quickly often acts as a catalyst for risk. Tighter capacity during peak months can tempt brokers to bypass standard security protocols to get a load on the road. Highway warns that this is exactly when criminals are most likely to strike.
The implications for the logistics sector are clear: Security must be a continuous process, not a one-time check.
The rise of the Certified Fraud Compliance Officer (CFCO) program underscores this shift. Technology, while essential, is only as effective as the human oversight behind it. As criminals continue to exploit the "real credentials, different people" model, the most effective defense is a well-trained team capable of spotting the nuances of identity fraud—such as a change in the tone of an email, a suspicious phone number, or a mismatch in the identity of the driver arriving at a warehouse.
The "paper trail" is no longer enough. To survive in an era of sophisticated identity-based theft, the industry must transition toward a culture of active, persistent verification. The most expensive mistake a brokerage can make is not a system failure, but a failure to recognize that the person on the other end of the screen is not who they claim to be. In a digital-first logistics world, trust must be earned, verified, and re-verified at every single touchpoint.
About the Author
