Cargo Theft Now Starts in the Inbox, Not the Truck Stop

Fewer thefts, much bigger losses

A thief who wants a truckload of freight no longer has to cut a fence. On November 4, Verisk CargoNet released its third quarter cargo theft report, and the numbers run backwards from what you’d expect. Theft incidents fell 33 percent compared to the same quarter last year. Losses still climbed 12 percent, to $230.1 million for the quarter.

The average documented theft is now worth $448,456. A year ago it was $261,115. That is a 72 percent jump in the value of a single stolen load. For a ten-truck carrier or a small brokerage, one loss at that size is not a bad quarter. It can be the whole year.

Through September, cargo theft has cost the industry $718.9 million in 2026, up 39 percent from the same period in 2025, even though incident counts dropped by a quarter, from 2,755 to 2,072, per Claims Journal’s coverage of the report. Thefts of $1 million or more happened 19 times in the third quarter, against 9 a year earlier. Fewer crews are stealing freight. The ones still working are stealing smarter, and they are picking bigger targets.

The theft that never touches your yard

The growth business is a kind of freight fraud that CargoNet calls the fictitious pickup. It now accounts for roughly a quarter of documented incidents, up from 18 percent a year ago, with 138 cases in the third quarter alone, according to The Trucker’s report on the CargoNet data.

Here is how it works. Criminals get into business email accounts, internet-based phone systems, and the load boards and apps the freight industry runs on. With that access they impersonate a legitimate carrier, book a real load, show up with paperwork that checks out, and drive away. Nobody breaks a lock. Your shipper or your dispatcher hands the trailer to the thief because every email, login, and phone call said it was the right company.

“We’re seeing criminals combine digital deception with traditional theft tactics,” said Keith Lewis, vice president of operations at CargoNet, in the Verisk release, “to identify, intercept and redirect high-value shipments.”

Read that again from the owner’s chair. The theft starts weeks earlier, inside an inbox. The parking lot part is just the pickup.

Your trucks are computers now

The industry’s own trade group has been saying this all fall. At the National Motor Freight Traffic Association’s trucking cybersecurity conference in Long Beach this fall, COO Joe Ohr told Transport Topics that a modern truck carries “over a hundred points of connectivity” across ELDs, telematics, dispatch apps, and the software that connects them. Cybersecurity, he said, is an operational issue, a safety issue, and a freight issue.

Small fleets tend to assume they are too small to interest anyone. The fictitious pickup math says the opposite. A criminal running carrier impersonation needs one thing: a believable identity. A five-truck carrier’s email account, with its real MC number, real rate history, and real relationships, is the cheapest believable identity on the market.

When the weak link is someone else’s network

Sometimes the hole is not in your shop at all. In August, attackers spent four days inside servers at CEVA Logistics, a CMA CGM subsidiary that runs about 1,000 warehouses worldwide. The intrusion disrupted operations at eight European warehouses and exposed names, home addresses, phone numbers, and order details for customers of one of its retail clients, as BleepingComputer reported. The client found out from the vendor, days after the attackers were already gone.

Your loads and your customer data ride on your partners’ systems: the broker’s TMS, the warehouse’s WMS, the factoring company’s portal. You cannot patch their servers, but you can ask them pointed questions, and you can decide how much standing access they get to yours.

The same test applies to your own IT provider. If the company managing your network has never asked how your dispatch desk verifies a new carrier, or what happens to a load-board login when a dispatcher quits, that silence is an answer. Carriers who feel stuck with a provider that does not understand freight can see how switching IT providers actually works, including what a clean handover looks like.

Cargo theft prevention that fits a small fleet

CargoNet notes it has historically seen theft activity climb in the fourth quarter and into the new year, and that it could escalate while facilities sit closed or short-staffed over the holidays. The weeks between Thanksgiving and New Year’s are exactly when a fraudulent pickup is most likely to sail through.

The defenses are not exotic. Turn on multi-factor authentication for email, load boards, and your TMS, every user, no exceptions. Require a callback to a known, previously saved phone number before releasing a load, changing a pickup, or updating payment details, and never use the number printed on the paperwork in front of you. Check new carriers against FMCSA records and watch for lookalike email domains one letter off from a real partner. Close accounts the same day someone leaves.

Verification deserves special attention because it is where these scams live. At Cyber Command, our own help desk uses double-blind verification: both sides confirm identity through a separate, pre-agreed channel before any password reset or remote session happens. It is designed to make impersonation expensive, and the same idea works at a dispatch desk. Our cybersecurity team builds this kind of human verification into the technical controls, and has written before about security practices for logistics companies.

Florida freight is on the same map

CargoNet’s report concentrates this quarter’s incidents in California, New Jersey, Texas, and Illinois, which together took 57 percent of them. Florida is not in that top four, and we will not pretend it is. But the playbook travels by email, and Florida moves freight through two major ports and some of the busiest interstate corridors in the country. A dispatcher in Ocoee gets the same spoofed carrier packet as one in Dallas.

Cyber Command supports trucking and industrial operations and other industries we serve across Orlando, Tampa Bay, and Jacksonville, with real humans answering 24/7 and no ticket black holes. If you want a second set of eyes on how your dispatch desk, email, and load-board access would hold up against a fictitious pickup crew, talk to us or call (407) 587-0089.

#CyberSecurity #ManagedIT #Trucking #Logistics #FreightFraud