Business Email Compromise in Freight: How Cargo Theft Happens

November 3, 2026

By LoadBetter Team, Content Team

Industry Insights

5 min read

Cargo theft incidents fell 26% in Q2 2026, but losses more than doubled. Learn how business email compromise and shipment misdirection threaten freight.

Cargo theft numbers tell two very different stories in 2026.

According to Verisk CargoNet, reported supply chain theft incidents across the United States and Canada fell 26% year over year in the second quarter. But estimated losses more than doubled, reaching $304.6 million.

Some traditional theft methods became less common. Meanwhile, fraud involving compromised business accounts, carrier impersonation, and shipment misdirection remained a persistent threat.

For freight brokers, shippers, and carriers, this creates a serious challenge. A shipment can be booked with a legitimate carrier, collected by an authorized driver, and still be diverted because someone trusted the wrong instruction.

With Thanksgiving approaching, now is a good time to review how shipment changes are verified, who can authorize them, and what happens when a trusted account or phone number is compromised.

Key Takeaways

Cargo theft incidents declined, but financial losses increased. CargoNet recorded 677 incidents in Q2 2026, down 26% year over year, while estimated losses climbed to $304.6 million.
Business email compromise remains a serious threat. CargoNet identified compromised business accounts as a primary access point in many sophisticated theft schemes.
Identity-based fraud remains persistent. Fictitious pickup incidents decreased only slightly, from 165 in Q2 2025 to 158 in Q2 2026.
The FBI has warned about cyber-enabled cargo theft. Criminals are compromising logistics accounts, impersonating legitimate businesses, posting fraudulent loads, and redirecting shipments.
Holiday periods create additional vulnerabilities. Reduced staffing, schedule changes, and shipment pressure can complicate verification.
Carrier vetting alone is not enough. Verifying a carrier's identity is different from verifying the authenticity of a shipment instruction.

Cargo Theft in 2026: Fewer Incidents, Higher Losses

CargoNet's second-quarter report highlights why incident counts alone cannot describe cargo theft risk.

The company recorded 677 supply chain theft incidents in Q2 2026, compared with approximately 915 during the same period in 2025.

That represents a 26% year-over-year decline and a 14% decrease from Q1 2026.

However, the financial impact moved in the opposite direction.

Estimated losses increased from

35.7 million in Q2 2025 to $304.6 million in Q2 2026.

The average value among thefts with a reported commodity value reached $564,009. CargoNet cautioned that this figure was heavily influenced by a relatively small number of multimillion-dollar incidents.

Traditional Theft Declined More Than Fictitious Pickup

CargoNet's incident classifications reveal another important difference.

Events classified as theft declined from 488 in Q2 2025 to 378 in Q2 2026.
Fictitious pickup incidents decreased only slightly, from 165 to 158.
Theft involving metals increased from 54 to 80 incidents.
High-value technology equipment remained a priority target.

CargoNet also reported significant declines in certain non-delivery schemes involving recently acquired motor carriers and in organized theft of unattended loaded equipment.

By contrast, business email compromise and shipment misdirection continued at comparatively steady levels.

This does not mean every type of fraud is increasing. It means the reduction in overall incidents has not translated into a similar reduction in account-compromise and misdirection activity.

Why High-Value Freight Matters

CargoNet reported that organized theft groups increasingly target commodities with substantial resale value.

Copper and other industrial metals remained attractive, alongside enterprise computing hardware, networking equipment, and cryptocurrency mining components.

These products can be worth millions of dollars while moving through ordinary transportation networks.

The result is a changing risk profile: fewer reported incidents during the quarter, but potentially much greater losses when a high-value shipment is successfully stolen.

How Business Email Compromise Leads to Cargo Theft

Business email compromise, commonly called BEC, involves criminals gaining unauthorized access to business email accounts or impersonating trusted senders to deceive other parties.

In freight transportation, that access can reveal shipment schedules, carrier relationships, delivery appointments, and operational contacts.

Criminals may then use the information to impersonate legitimate parties and issue fraudulent shipping instructions.

The FBI's April 30, 2026 public alert describes several ways these attacks can unfold.

Step 1: Gain Access to a Trusted Account

An attacker may start with a phishing email disguised as a carrier agreement, brokerage document, or service review notification.

The message directs the recipient to a malicious website or file.

If the attack succeeds, the criminal may obtain credentials or install software that provides access to the victim's systems.

The FBI also warns about criminals using compromised accounts to post fraudulent loads on load boards.

These listings can become another way to target legitimate carriers and obtain access to their systems.

The initial compromise can provide access to information beyond a single email inbox, including shipment details, contact directories, and transportation management tools.

Step 2: Learn How the Business Operates

Once a criminal gains access, the next step may involve observing normal operations.

Shipment information can reveal which carriers move certain commodities, who approves appointments, when high-value freight is scheduled, and how dispatch teams communicate.

This makes later impersonation attempts more convincing.

A fraudulent instruction may reference an actual shipment, carrier, driver, or appointment.

That familiarity can make the request appear legitimate even when the person sending it is unauthorized.

Step 3: Introduce a Fraudulent Change

The criminal may attempt to change one important detail:

A pickup or delivery address.
The final consignee.
The driver or equipment assigned to a load.
An appointment or transfer location.
Payment or remittance instructions.

The message may come from a compromised account, a lookalike email domain, or someone impersonating a trusted contact over the phone.

Not every attempt involves email. Some rely entirely on deceptive calls or text messages.

Step 4: Redirect the Shipment

Once an unauthorized instruction is accepted, the freight may move outside the legitimate shipment plan.

In some cases, criminals impersonate motor carriers and use fraudulent documents to obtain loads.

In others, they deceive a legitimate driver into taking freight to an unauthorized destination or transferring it to another vehicle.

The FBI has also warned that criminals sometimes change carrier contact or insurance information in FMCSA-related records to make fraudulent activity appear credible.

The important lesson is that a legitimate carrier and an authorized pickup do not guarantee that every later instruction is authentic.

Verification needs to continue when shipment details change.

A Real Example: The $273,000 Seafood Diversion Attempt

On October 3, 2026, police in North Arlington, New Jersey, interrupted an attempted theft involving approximately 29,000 pounds of frozen seafood.

The shipment was valued at more than $273,000.

According to police accounts reported by FreightWaves, the legitimate truck driver received phone calls and text messages from someone falsely claiming to represent the freight broker responsible for the load.

The driver was instructed to divert part of the shipment to another location for a supposed transfer.

At that location, two individuals began moving pallets from the refrigerated tractor-trailer into a box truck.

Police intervened, recovered the shipment, and took two suspects into custody.

The case illustrates a critical weakness in shipment security.

The driver did not need to be an impostor for the theft attempt to occur. A legitimate driver was persuaded to follow instructions from someone pretending to be an authorized brokerage contact.

Authorities have not publicly established that a compromised email account caused this specific incident.

It was a case of broker impersonation and shipment misdirection, demonstrating why verification must extend beyond the original load booking.

Why Thanksgiving Creates Additional Cargo Theft Exposure

Thanksgiving presents a combination of operational pressures that can make verification more difficult.

Freight may be moving under tighter deadlines while offices operate with reduced staffing.

Temporary coverage arrangements, changes to pickup schedules, and unfamiliar personnel can make it harder to confirm whether an instruction is legitimate.

CargoNet has documented elevated theft activity during previous Thanksgiving periods.

What Historical Data Shows

In its 2025 Thanksgiving advisory, CargoNet reported:

79 cargo theft incidents during the 2024 Thanksgiving analysis period.
48 incidents during the equivalent period in 2023.
Food and beverage freight was the most frequently targeted category in the 2024 analysis, with 31 incidents.

CargoNet defines its Thanksgiving analysis period as the Tuesday before Thanksgiving through the following Monday.

For 2026, that period runs from November 24 through November 30.

Separate Labor Day research also provides useful context.

CargoNet analyzed 273 theft events during Labor Day holiday periods from 2021 through 2025. It found that 71% occurred on the Thursday, Friday, Tuesday, and Wednesday surrounding the holiday weekend.

That figure applies to Labor Day, not Thanksgiving. However, it highlights an important operational point: theft and deception risks can remain significant on working days around holidays, not just during office closures.

What to Prepare Before November 24

Brokers and shippers should confirm two essential procedures before the Thanksgiving period:

Who is authorized to approve changes to pickup, delivery, driver, or payment instructions when the usual contact is unavailable?
Which independently established contact details must employees use to verify those changes?

Having a documented answer can help teams avoid improvising when an unexpected request arrives.

Six Ways to Reduce Business Email Compromise and Shipment Misdirection Risk

No single control can eliminate cargo theft or fraud.

However, combining account security, independent verification, clear approvals, and consistent operational procedures can make deceptive requests harder to execute.

1. Independently Verify Shipment Changes

Unexpected changes to shipment instructions should trigger an independent verification process.

This is particularly important for delivery addresses, pickup locations, consignees, drivers, and payment details.

Employees should contact the authorized party through a trusted number or channel established before the suspicious request.

Do not rely solely on contact details supplied in the message requesting the change.

The FBI specifically recommends secondary verification of shipment requests and pickups before freight is released.

For high-value shipments, consider requiring confirmation through a second trusted contact or channel.

2. Require Additional Approval for Sensitive Changes

Not every operational adjustment carries the same level of risk.

A routine appointment update may be lower risk than an unexpected delivery diversion or change in payment details.

Identify changes that require an additional approval.

For example:

Changes to the delivery destination.
Requests to transfer freight to another vehicle.
Last-minute changes to the assigned carrier or driver.
Changes to bank accounts or remittance details.

A second authorized person can review the request before the change is accepted.

The goal is not to slow down every shipment. It is to create a consistent control around changes that could result in a significant loss.

3. Secure Email and Logistics Accounts

Freight operations rely on multiple connected systems, including email, TMS platforms, load boards, business phone systems, and compliance tools.

Compromising any of these may expose sensitive shipment information.

Useful security practices include:

Enable multifactor authentication, preferably phishing-resistant authentication where supported.
Limit account access according to employee responsibilities.
Review unexpected mailbox forwarding and deletion rules.
Monitor suspicious sign-ins and unusual account activity.
Promptly revoke access when employees or contractors leave.
Keep software updated and investigate unexpected document downloads.

The FBI specifically identifies malicious links disguised as carrier documents or service review requests as part of cyber-enabled cargo theft schemes.

Account security should therefore be treated as part of freight security, not just an IT responsibility.

4. Verify Email Addresses and Contact Changes

A familiar display name does not establish that a message is authentic.

Criminals may use lookalike domains, modified email addresses, temporary phone numbers, or compromised legitimate accounts.

When receiving an unexpected instruction:

Check the full sender address and domain.
Be cautious of unfamiliar links and document requests.
Verify contact changes independently.
Do not treat an existing email conversation as proof that every participant is legitimate.

This also applies when carrier details appear to have changed in a public database.

The FBI has warned that criminals may manipulate carrier contact and insurance information associated with FMCSA records.

5. Confirm Driver and Equipment Details at Pickup

Verification should not stop when a carrier accepts a load.

Shippers and facilities should compare the arriving driver and equipment with the information provided through an authorized channel.

Depending on the shipment and the company's procedures, this may include checking:

Carrier identity and operating authority.
Driver identification.
Truck and trailer identifiers.
Pickup reference numbers.
Authorized appointment details.

If material information does not match, the facility should pause release until the discrepancy is resolved through an established verification process.

The FBI also recommends maintaining relevant documentation to assist investigations.

Any collection or retention of identification documents and personal information should follow applicable privacy requirements and company policies.

6. Establish Clear Communication Channels

Freight operations often involve multiple communication channels.

A single load may generate emails, calls, texts, load board messages, and TMS updates.

When important instructions are spread across disconnected systems, employees may struggle to determine which information is authoritative.

Create a clear process for recording shipment instructions, approvals, and changes.

Where possible, designate a primary operational system and keep relevant communications associated with the shipment.

That does not eliminate the risk of account compromise, but it can make unexpected changes easier to identify and investigate.

What Brokers and Shippers Should Ask Each Other

Freight security requires coordination between the parties involved in moving a shipment.

For shippers:

How does your broker verify an unexpected carrier, driver, or delivery change? Who approves it, and what happens when the usual contact is unavailable?

For brokers:

Who at the shipper can authorize changes to delivery instructions? How do you confirm those requests independently?

For carriers:

What is the process when a driver receives unexpected instructions about a different delivery location or an unscheduled transfer?

These questions should have clear answers before a suspicious situation occurs.

What to Do If Shipment Misdirection or Cargo Theft Is Suspected

If a shipment may have been diverted, quick coordination is important.

Depending on the circumstances, immediate steps may include:

Contact law enforcement. Report the suspected theft to the appropriate authorities and provide shipment details.
Confirm the last verified location. Coordinate with the legitimate driver, carrier, broker, and shipper through established contact information.
Notify relevant parties. Contact insurers and other appropriate parties according to existing incident-response procedures.
Preserve evidence. Retain relevant messages, email headers, call records, transaction documents, and system logs.
Secure potentially compromised accounts. Involve IT or security personnel to investigate unauthorized access and revoke affected sessions or credentials where necessary.
Report cyber-enabled cargo theft to the FBI. The FBI directs victims to the Internet Crime Complaint Center at ic3.gov or their local FBI field office.

CargoNet can also receive theft reports and assist with information-sharing and recovery efforts.

The FBI warns that criminals sometimes impersonate carriers again after the theft and demand payment in exchange for the shipment's location.

Any such communication should be preserved and shared with law enforcement.

Companies should also review their cargo insurance coverage before an incident occurs. Policies may treat theft, fraud, fictitious pickup, and voluntary parting differently, and coverage depends on the policy wording and facts.

Frequently Asked Questions

What Is Business Email Compromise in Freight?

Business email compromise involves attackers accessing or impersonating business email accounts to deceive logistics personnel.

In freight transportation, criminals may use compromised communications to obtain shipment information, impersonate brokers or carriers, and redirect freight or payments.

What Is the Difference Between Traditional and Strategic Cargo Theft?

Traditional cargo theft commonly involves physically stealing freight or loaded equipment.

Strategic cargo theft uses deception, impersonation, or fraudulent arrangements to obtain control of a shipment.

Examples include fictitious pickup and shipment misdirection.

Some strategic theft schemes involve compromised accounts, while others rely on fraudulent documents, phone calls, or impersonation.

Is Cargo Theft Increasing in 2026?

The available data presents a mixed picture.

CargoNet reported fewer overall supply chain theft incidents in Q2 2026 compared with the same quarter in 2025.

However, estimated financial losses more than doubled, and business account compromise and shipment misdirection remained persistent threats.

A single quarter does not establish the direction of every type of theft throughout the year.

Which Commodities Are Most Frequently Targeted?

Patterns vary by period and theft method.

CargoNet's Q2 2026 report highlighted increasing theft involving metals, particularly copper, and continued targeting of high-value enterprise technology.

Its historical Thanksgiving analysis identified food and beverage shipments as the most frequently targeted category during the 2024 holiday period.

Can Carrier Vetting Prevent Business Email Compromise?

No.

Carrier vetting is an important part of determining whether a carrier is legitimate and meets a company's qualification requirements.

However, even legitimate carriers and authorized drivers can be deceived by fraudulent instructions.

Carrier qualification, account security, and shipment-change verification should be treated as separate but complementary controls.

When Should Businesses Be Most Vigilant Around Thanksgiving?

CargoNet's historical research indicates that holiday periods can create additional cargo theft exposure.

Businesses should pay particular attention to reduced staffing, unexpected pickup or delivery changes, and shipment handoffs before and after the holiday.

For Thanksgiving 2026, CargoNet's standard analysis window runs from November 24 through November 30.

Where LoadBetter Fits

For freight brokers and shippers, having an organized load coverage process can help reduce the operational confusion created by disconnected communications.

LoadBetter provides a Private Marketplace where brokers and shippers can work with their existing carrier networks.

They can share available loads, receive bids and counteroffers, and manage awards through a centralized workflow.

Carriers can also respond to available freight through the platform's supported booking and bidding options.

When additional capacity is needed, LoadBetter's Public Marketplace offers another way to reach the market.

Keeping load offers, bids, and awards associated with the shipment can make these parts of the coverage process easier to manage.

However, LoadBetter is not a cybersecurity, fraud detection, or cargo theft prevention system.

LoadBetter does not guarantee shipment security, verify driver identity at pickup, or vet, verify, approve, or qualify carriers. Users remain responsible for their own carrier qualification, operational controls, account security, and shipment verification.

The objective is simpler: help brokers and shippers manage load coverage and their carrier relationships more efficiently.

Final Thoughts

The latest available CargoNet quarterly data shows why freight companies cannot judge cargo theft exposure by incident volume alone.

Although reported incidents declined in Q2 2026, financial losses increased significantly, and compromise-based fraud remained persistent.

For brokers, shippers, and carriers, the practical response is to strengthen verification throughout the shipment lifecycle.

Verify unexpected changes, protect business accounts, establish clear approval procedures, and make sure employees know whom to contact when something does not match.

With Thanksgiving approaching, these are useful processes to review before operational pressure increases.

Sources

This article provides general educational information for freight industry professionals, current as of November 3, 2026. Cargo theft statistics reflect incidents reported to or recorded by CargoNet and do not represent every theft across the United States and Canada. The recommendations above are risk-reduction practices, not security guarantees or legal advice. Companies should assess their specific operational, contractual, insurance, privacy, and cybersecurity requirements.