By Michael Nielsen, Publisher | 15+ Years in Diesel Repair
Last Updated: October 2026
⏱ Estimated reading time: 14 minutes
Freight phishing scams are fake emails, texts, calls and load postings aimed at carriers, brokers, dispatchers, drivers and accounting staff, designed to steal logins, redirect payments or take freight. Artificial intelligence (AI) makes the messages cleaner and the voices more convincing, but the defense is still to verify through a second channel.
This guide from Heavy Duty Journal (HDJ), written by publisher Michael Nielsen, explains how the scams work, what the evidence shows, which controls help and what to do after a click. It draws on the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST) and the National Motor Freight Traffic Association (NMFTA).
The earlier version quoted a 300% ransomware surge, an 85% human error rate and detailed cost tables. As of October 2026, HDJ found no primary source for those figures and removed them. The guide now uses figures that can be traced.
Key Takeaways
- ✓Verify through a second channel. Call back on a number from your own records before acting on any payment, login or load request.
- ✓AI removes the old tells. CISA says some phishing emails now have perfect grammar and spelling.
- ✓Use phishing-resistant authentication. CISA calls it the gold standard and says to start with email and remote access.
- ✓Keep backups offline. CISA recommends offline, encrypted backups and regular restore tests.
- ✓Report fast. Report to the FBI's Internet Crime Complaint Center (IC3), your local FBI field office and CISA.
In This Guide
- What Freight Phishing Scams Are
- What AI Changes and What It Does Not
- What the Data Shows About Freight Phishing Scams
- Common Freight Phishing Scams Aimed at Fleets
- Deepfake Voice and Video Requests
- Recognizing a Phishing Attempt
- Payment and Dispatch Verification
- Technical Controls That Limit the Damage
- Training and Reporting
- What to Do After Someone Clicks
- Reporting and Legal Obligations
- What HDJ Removed From the Earlier Guide
- Frequently Asked Questions
- The Bottom Line
What Freight Phishing Scams Are
The FBI's April 2026 alert describes how these scams reach freight. Actors send spoofed emails or shortened or fake links, often about carrier agreements or negative service reviews. The links lead to phishing sites that install remote monitoring software, giving the actors covert control of systems.
With a compromised carrier account, the alert says actors post fraudulent loads, sometimes in the tens of thousands. Legitimate carriers who bid receive malicious agreements that compromise their own systems. The FBI alert of April 30, 2026 on cyber-enabled strategic cargo theft also describes actors who change carriers' contact details and insurance information to look legitimate.
The fraud alerts page from the Federal Motor Carrier Safety Administration (FMCSA) shows what regulators' impersonators send. Recent examples include a bogus Motus portal in August 2026, a fake audit request on June 30, 2026, and fake notices asking carriers to verify a payment and fuel system linked to a Motor Carrier (MC) or U.S. Department of Transportation (USDOT) number.
What AI Changes and What It Does Not
The FBI alert of December 3, 2024 on generative artificial intelligence and financial fraud says criminals use generative AI to commit fraud at larger scale, making schemes more believable and requiring less effort. It lists text for spear phishing, translation tools that remove telltale grammar errors, fake identity documents, short cloned audio clips and real-time video chats with fake executives.
The 2026 Transportation Industry Cybersecurity Trends Report from the National Motor Freight Traffic Association (NMFTA) reports attackers using AI-generated emails, deepfake voice calls and spoofed dispatch updates to misdirect shipments or extort fraudulent fees. It says automated scanning means small fleets are not safe from AI-assisted campaigns. It also expects social engineering to stay the most effective attack vector in 2026.
Note what is missing. As of October 2026, HDJ found no trucking-specific study measuring how much AI raised phishing success rates. The reports describe the tactics, not the odds. The earlier version's claims that deepfakes raised cargo theft attempts 340% and that compromise takes 4.5 hours had no source.
What AI does not change is the goal, which is money, credentials or freight, or the best defense. A perfect message still cannot answer a call-back to a number you already had. That is the idea behind the rest of this guide.
What the Data Shows About Freight Phishing Scams
The IC3's 2024 annual report counted 21,442 business email compromise (BEC) complaints with losses of about $2.77 billion in 2024, and 193,407 phishing and spoofing complaints. It also counted 3,156 ransomware complaints, up from 2,825 in 2023, and 4,878 complaints from critical infrastructure organizations. The extracted text gives no transportation breakdown.
The cargo theft numbers are the closest freight-specific measure. The FBI's April 2026 alert cited estimated 2025 cargo theft losses of nearly $725 million, up 60% from 2024, the same figure Verisk CargoNet reported. The alert describes the rise as cyber-enabled but does not say how many cases began with phishing.
The earlier version cited a 300% rise in transportation ransomware attributed to federal law enforcement. HDJ found no such figure in IC3's 2024 report. NMFTA says ransomware groups time attacks around peak shipping periods and are shifting toward data theft for extortion over encryption, but it gives no multiplier.
The earlier 85% human error figure, the 99.9% multi-factor authentication claim and the tables of costs and recovery times also had no traceable source. Cost estimates for trucking breaches are hard to find. HDJ would rather give none than repeat numbers that cannot be checked.
Common Freight Phishing Scams Aimed at Fleets
Fake loads and compromised accounts
The FBI describes actors who hijack real loads. Posing as compromised carriers, they accept real shipments and double-broker them to partly unwitting drivers using manipulated bills of lading and altered destinations. HDJ's guide to fictitious pickup fraud covers the dock side.
Payment redirects and fake invoices
BEC is the quiet money version. A message that appears to come from a broker, vendor or executive asks for a changed bank account or an urgent payment. The IC3 numbers above show how common it is across all industries. HDJ's guide to freight fraud prevention covers payment checks.
Fake regulator and portal notices
FMCSA's alerts include spoofed portals using .com instead of .gov, requests for insurance certificates, tax letters and driver's license copies, and forms asking for Social Security numbers and USDOT PINs, which FMCSA says it does not require. Treat any unexpected notice as unverified until you log in the normal way.
Fake help desk calls and pasted commands
NMFTA reports attackers posing as information technology help desk staff to get employees to install remote access software, and AI-generated phishing paired with a technique called ClickFix that tricks employees into running malicious commands. No legitimate help desk needs a driver or dispatcher to paste commands from a message.
Deepfake Voice and Video Requests
The FBI says criminals use short cloned audio clips and real-time video chats with fake executives. NMFTA says fraud investigators and insurers have documented AI voice calls impersonating managers and executives. HDJ found no trucking-specific loss figure for deepfakes, and the earlier version's per-incident dollar amounts were removed.
The FBI's advice is to hang up and call the organization directly using a number you look up yourself. It also lists visual flaws to look for in images and video, such as distorted hands or feet and inaccurate shadows. HDJ treats those as clues, not a test, because quality will keep improving.
⚠️ Safety Warning
Never approve a payment, password reset, load change or software install on a call or video alone, even if the voice and face are familiar. Hang up and call back on a number from your own records.
A practical rule for fleets: any request that involves money, credentials or a changed destination gets a call-back, whoever appears to be asking. That includes the owner. HDJ found no study of whether shared code words work in business settings, so treat them as optional.
Recognizing a Phishing Attempt
The CISA's phishing guidance lists four signs: urgent or emotionally charged language, requests for personal or financial information, untrusted shortened links, and incorrect email addresses or links. It adds that some emails now have perfect grammar and spelling, so a clean message proves nothing.
The FBI's cargo theft alert adds indicators specific to freight: unauthorized shipment contacts, spoofed domains on free email services, look-alike domains, unauthorized mailbox rules, and short-lived phone numbers. HDJ's guide to electronic logging device (ELD) cybersecurity covers the in-cab side.
CISA's reporting steps are simple: do not reply or click anything, use the report option in your email program, and delete the message. Add one habit that fits freight: if the message is about a load or money, look up the sender's number yourself and call.
Practitioner red flags, with no study behind them: a request to move the conversation to a personal email or messaging app, a request to disable tracking, a rate far below market, and urgency that leaves no time to call. Several together should stop the transaction.
Payment and Dispatch Verification
The table lists requests that should always trigger a check, how to verify each one and how the check can still fail. It is HDJ practitioner guidance built on the FBI and CISA advice, not a standard.
| Request | Verify by | How the check can still fail |
|---|---|---|
| Changed bank account | Call the contact from your own records; second person approves | The "records" number was recently changed by an impostor |
| New pickup or destination | Confirm with the shipper on a known number | A compromised account can send a believable update |
| Urgent payment from an executive | Call back; never use the number in the message | A cloned voice answers a number the criminal supplied |
| "Verify your portal" or login notice | Open the portal by typing the address yourself | A look-alike site reached from a saved bad link |
| Run a command or install software | Ask your own IT contact; do not comply on the spot | A fake help desk has already built trust |
Separate the people. The person who receives a payment change should not be the only one who can approve it. HDJ found no data on thresholds for second approval, so set yours by what a loss would cost you.
Contact details are a weak point. The FBI says actors change carriers' contact details, so check when a number last changed before relying on it. HDJ's guide to carrier identity theft explains how stolen identities are used.
Technical Controls That Limit the Damage
Technical controls limit the damage when someone is fooled. The first is authentication. The CISA's multifactor authentication guidance calls phishing-resistant methods such as security keys the gold standard and advises starting with email, file storage and remote access. Text-message codes are the weakest option, in CISA's ranking.
Key Recommendation
Turn on phishing-resistant multi-factor authentication (MFA) for company email, remote access and payment accounts first. Use a security key or authenticator app where offered, and a text-message code only when nothing stronger exists.
The NIST Special Publication 800-63B-4 restricts the use of the public telephone network for out-of-band verification and says phishing-resistant authentication is required at its highest assurance level. NMFTA calls MFA on remote sessions a baseline and says insurers now commonly request proof of it.
Email authentication helps protect your domain. The NIST Special Publication 800-177 Revision 1 describes Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC) as ways to verify the domain that sends an email. They do not stop look-alike domains or a criminal using a compromised real account, which is HDJ's reading.
Keep backups offline. The CISA's #StopRansomware Guide recommends offline, encrypted backups of critical data, regular tests of their availability, and email filters that block known malicious indicators and risky attachments. It notes that many ransomware variants try to delete or encrypt accessible backups.
Drivers' phones matter too, because phishing is not only email and messages can arrive by text. Keep devices updated and locked, report a lost phone at once, and use cellular data or a company hotspot for company systems. HDJ found no federal figure on how often truck stop networks are attacked, so the earlier version's claim was removed.
HDJ's guide to fleet cybersecurity covers the connected-vehicle side. HDJ found no evidence for the earlier version's claims that zero trust cuts breaches by a stated amount or that biometrics make impersonation virtually impossible, so both were removed.
Training and Reporting
Staff are the last control, but the evidence on training is mixed. HDJ's guide to trucking cybersecurity training covers what studies show. In short, generic videos appear to do little, while scenarios built around real decisions plus a forced check do more.
NMFTA recommends role-based training that mirrors real workflows, such as verifying pickup authorizations and confirming payment changes through separate channels. Use your own near misses as examples. HDJ found no study of ideal session length, so the earlier version's five-minute module claim was removed.
Make reporting easy and safe. Give everyone one number or address for suspicious messages, and never punish a click or a report. That is practitioner reasoning: employees who fear blame hide mistakes, and a hidden mistake gives attackers time.
What to Do After Someone Clicks
The CISA response checklist starts with detection and analysis: determine which systems are affected and isolate them immediately. It then calls for reporting to CISA and your local FBI field office, containment and eradication, and recovery from offline, encrypted backups. It also asks organizations to document lessons learned.
For a phishing click, HDJ's practitioner steps add: disconnect the device, change passwords from a clean device, revoke active sessions, and look for new mailbox rules, which the FBI lists as an indicator. If money moved, call your bank at once, since speed matters for any recall.
CISA's guide does not say whether to pay a ransom. Talk to law enforcement and your insurer before any decision. HDJ's guide to ransomware recovery covers what happens next. The earlier version's response-time cost table had no source and was removed.
Reporting and Legal Obligations
Report phishing and fraud to the FBI's IC3 and your local FBI field office. CISA accepts voluntary reports. FMCSA's fraud alerts page also lists the Federal Trade Commission, local police, state attorneys general and the FMCSA Contact Center for carrier-targeted fraud.
As for rules, the CISA's page on the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) says organizations are not required to submit incident or ransom payment reports until the final rule takes effect. It describes 72 hours for covered incidents and 24 hours for ransom payments. Federal News Network reported CISA expected to issue the final rule in September 2026.
As of October 2026, HDJ found reports that CISA sent the draft final rule to White House review on October 1 and that the rule has not been published. HDJ cannot say whether a small fleet would be covered. Watch for the final text.
The earlier version said Transportation Security Administration (TSA) requirements and the FMCSA commercial driver's license program impose incident obligations on fleets. HDJ found none. TSA's November 2024 proposed rule would cover pipelines, rail and certain bus operators, not trucking. State breach laws vary, so ask an attorney. Also check your policy's notice terms.
What HDJ Removed From the Earlier Guide
A refresh should say what changed. HDJ removed the 300% ransomware surge, the 85% human error figure, the 340% rise in cargo theft attempts, the 99.9% multi-factor authentication claim, the 89% lower ransom and three-times-faster recovery claims, and every dollar figure in the cost, response-time and attack-method tables.
It removed the 25 GB per day data figure, the 4.5 hours to compromise, the $2 million total impact, the state privacy penalty claim and the TSA and driver-license obligations. It replaced the SMS-based password and MFA advice with CISA and NIST wording, and removed seven images, vendor-style links and the old newsletter and tools boxes.
Frequently Asked Questions
What are freight phishing scams?
Freight phishing scams are fake emails, texts, calls and load postings aimed at carriers, brokers, dispatchers and drivers to steal logins, redirect payments or take freight. The FBI describes spoofed emails, fake loads posted from compromised accounts and hijacked real shipments that are double-brokered to unwitting drivers.
How does AI change freight phishing scams?
AI makes messages and voices more convincing. The FBI says criminals use it for spear phishing, removing grammar errors, cloned audio and video chats with fake executives. HDJ found no trucking study measuring how much it raised success rates, so treat claims of exact increases with caution.
How can I spot freight phishing scams when the message looks perfect?
Do not rely on grammar. CISA says some phishing emails now have perfect grammar and spelling. Check for urgency, requests for money or information, shortened links and wrong addresses, then verify the request by calling a number you looked up yourself, not one in the message.
What payment checks stop freight phishing scams?
Call the contact from your own records before changing any bank detail, require a second person to approve it, and treat a recent change to a phone number as a red flag. Never use the number in the message that asked for the change.
Does multi-factor authentication stop freight phishing scams?
It limits damage but not every attack. CISA calls phishing-resistant methods such as security keys the gold standard and ranks text-message codes weakest. Start with email, remote access and payment accounts, and keep payment call-backs as a separate check, because a fooled employee can still approve a payment.
What should I do right after someone clicks a phishing link?
Disconnect the device, change passwords from a clean device, revoke sessions, and report to IC3, your local FBI field office and CISA. CISA's checklist starts with isolating affected systems. If money moved, call your bank immediately, and document what happened.
The Bottom Line
Freight phishing scams are beaten by process more than detection. Verify money, login and load requests through a second channel, use phishing-resistant authentication on key accounts, keep offline backups and make reporting easy. HDJ could not verify the figures it removed.
Michael Nielsen and the HDJ editorial team publish more fleet security guidance at heavydutyjournal.com. This week, turn on stronger multi-factor authentication for company email, write down your call-back rule for payment and destination changes, and tell staff where to report a suspicious message.
Share This Fleet Security Guide
Know a dispatcher, accountant or owner who handles loads and payments by email? Share this guide with them. Michael Nielsen and Heavy Duty Journal publish it free at heavydutyjournal.com.
