DRAFT: private preview. Not published. Do not share the link. About text, contact and newsletter are placeholders.
Skip to content
Cargo Theft WatchCargo Theft Watch home

Pattern library

How the freight actually leaves.

21 patterns show up in public reporting. Learn the shape. You will start seeing the same moves in rate confirmations, emails, and at the dock.

Showing 21 of 21 patterns

  1. Pattern 1

    Carrier identity theft and impersonation

    Also called: The lookalike authority

    Identity and authority fraudCarriersBrokers

    A real carrier ID (MC) number, a wrong email, and a truck that isn’t on the insurance.

    What it looks like

    The rate confirmation uses a carrier that really exists. The legal name is close. The email is off by a letter, a hyphen, or a free inbox. The phone in the email is not the phone on the FMCSA record. CargoNet says criminal networks now mostly impersonate real carriers and brokers, and the FBI describes criminals changing a carrier’s FMCSA contact and insurance details so verification calls go to them.

    What to do

    Open the company snapshot and call the phone number on that record, not the one in the message. Read the legal name out loud and compare it to the rate confirmation. If they don’t match, don’t dispatch. Check your own FMCSA record regularly for contact or insurance changes you didn’t make.

    Full explanation, warning signs and every step

    How it works

    CargoNet's Q1 2026 analysis says criminal networks have largely settled on impersonating legitimate carriers and brokers. They either harvest credentials with phishing and remote-access malware to operate as the real carrier, or buy a carrier outright. The FBI's 2026 notice also describes criminals changing a carrier's FMCSA contact and insurance information so verification calls go to them.

    Warning signs

    • Your carrier's phone number or email changed recently
    • A call from "your carrier" comes from a VoIP or temporary number
    • Shipping activity in your company's name that you did not book
    • Verification emails that come from free-provider or look-alike domains

    All the steps

    • Check your own FMCSA registration regularly for contact or insurance changes you did not make
    • Verify any new contact by calling a number you already trust
    • Use multi-channel verification before tendering or releasing freight
    • Report impersonation of your company to FMCSA and the FBI (see I got hit)

    Sources

  2. Pattern 2

    Double brokering and the fake pickup

    Identity and authority fraudCarriersBrokersShippers

    The company you booked quietly hands your load to someone you never vetted.

    What it looks like

    A broker, or a fake “carrier,” takes the freight and passes it to someone else without telling you. Sometimes the second hand is a thief. The carrier name or code on the bill of lading is not the carrier you booked, and the broker won’t say who is hauling the load. The real carrier whose name was used often never knows.

    What to do

    Before tendering, match the legal name, MC/USDOT number and phone to FMCSA’s public records, and call the carrier back on the number FMCSA lists. If the broker won’t say who is hauling, treat that as the answer. Check the driver’s ID, plates and USDOT number at pickup and photograph them.

    Full explanation, warning signs and every step

    How it works

    A person books a load with a broker or shipper by posing as a real carrier, then passes it to a different driver or to a thief. The real carrier whose name was used often never knows. FMCSA lists double brokering and fake carrier identities as core forms of broker and carrier fraud, and NMFTA notes that a different carrier code on the bill of lading is a common sign.

    Warning signs

    • The carrier name or code on the bill of lading does not match the carrier you booked
    • The driver shows up for a carrier you never dealt with
    • The dispatcher asks the driver to present as a different company name
    • A "ghost" carrier with no verifiable identity appears in the paperwork
    • The broker will not tell you who is hauling the load

    All the steps

    • Before tendering, match the legal name, MC/USDOT number and phone number to FMCSA's public records
    • Call the carrier back on the number FMCSA lists, not the number in the email
    • Check the driver's ID, plate and USDOT number at pickup and photograph them
    • Put a no-double-brokering clause in your contracts and enforce it
    • If a load has already gone to the wrong party, call local police and see the I got hit page

    Sources

  3. Pattern 3

    Email takeover and look-alike domains

    Also called: The changed thread

    Email, phishing and account takeoverCarriersBrokersShippers

    A real email chain gets one quiet edit.

    What it looks like

    Pickup number, warehouse address, or the factoring voided check changes late. The note looks like it came from someone already on the thread. Often the inbox was compromised, or the reply came from a look-alike domain. CargoNet calls business email compromise the primary access point for sophisticated schemes, and the FBI describes hidden mailbox rules (forwarding, auto-delete) and spoofed domains.

    What to do

    Don’t trust the thread. Call a number you already had on file, from before this load. Confirm the address, the pickup number, and where the money goes. One changed line is enough to stop. Turn on multi-factor authentication and check your mailbox rules for forwarding or auto-delete you didn’t set up.

    Full explanation, warning signs and every step

    How it works

    CargoNet's Q2 2026 report calls business email compromise the primary access point for sophisticated schemes. The FBI describes criminals who set up unauthorized mailbox rules, such as forwarding and auto-delete, use spoofed domains from free providers, and use shortened or spoofed links.

    Warning signs

    • Unexplained mailbox rules, forwarding or auto-delete
    • A sender whose domain is a character or two off the real one
    • Replies that arrive from a different address than the original
    • Shortened or odd links in documents

    All the steps

    • Turn on multi-factor authentication for email and load-board accounts
    • Check mailbox rules and sign-in history for anything you did not set up
    • Verify any pickup, rate or payment change by phone with a known number
    • If you suspect takeover, change passwords from a clean device and report to IC3

    Sources

  4. Pattern 4

    Load held for ransom

    Also called: Hostage freight

    Physical and strategic theftBrokersShippers

    The load is on the truck, then someone invents a fee to let it move.

    What it looks like

    After pickup, the “carrier” stops answering, then a new contact calls the shipper or broker and demands money before the load will move. NICB describes loads won by impersonating a carrier on a load board, moved somewhere undisclosed, then held for payment. Even when the ransom is paid, many shipments are never recovered.

    What to do

    Don’t pay a new party from a new message. Call the carrier on the FMCSA number and the broker on the number you booked with. If the freight is being held for a surprise payment, treat it as theft in progress and write down every number that called. Talk to the police and your insurer before paying anything.

    Full explanation, warning signs and every step

    How it works

    NICB describes loads gained through impersonation on broker load boards, moved to an undisclosed location, followed by a call to the shipper or broker demanding payment. Even when ransom is paid, many shipments are never recovered. The FBI's 2026 notice also notes that some schemes involve demands for payment.

    Warning signs

    • A carrier stops answering after pickup
    • A new contact demands payment for "release" of the load
    • Pressure to pay quickly and keep police out of it

    All the steps

    • Do not pay without talking to law enforcement and your insurer first
    • Preserve all messages and call logs
    • Report to local police, IC3, and the carrier's insurer
    • Tell your insurer immediately

    Sources

  5. Pattern 5

    Strategic cargo theft and shipment redirect

    Physical and strategic theftCarriersBrokersShippers

    They book like a normal carrier. The trailer never arrives.

    What it looks like

    The load is tendered to what looks like a legitimate carrier, and it moves. Then the delivery address or appointment changes mid-transit, on a request that doesn’t come from the cargo owner, or the updates start to look slightly off for the lane. NICB defines strategic cargo theft as events started by deception at the supplier, broker or transporter. CargoNet expects these groups to focus on misdirecting shipments tendered to legitimate carriers.

    What to do

    Allow re-routing only from the owner of the cargo, in writing, with a call-back. Verify identity through the whole shipment, not only at tender. Keep tracking and check-in schedules, and escalate missed ones fast.

    Full explanation, warning signs and every step

    How it works

    NICB defines strategic cargo theft as events started through deception at one of the links in the supply chain: the supplier, broker or transporter. In some cases all three links were infiltrated. CargoNet expects "theft by deception" groups to focus more on misdirecting shipments tendered to legitimate carriers, going around controls that focus on the tender stage.

    Warning signs

    • A delivery address or appointment changes mid-transit
    • A change request that does not come from the cargo owner
    • Tracking updates that look slightly off for the lane
    • Communication shifts to a new phone number or email

    All the steps

    • Allow re-routing only from the owner of the cargo, in writing, with a call-back
    • Verify identity through the whole shipment, not only at tender
    • Keep tracking and check-in schedules and escalate missed ones fast
    • If misdirected, call the police and your insurer and begin the I got hit steps

    Sources

  6. Pattern 6

    Fictitious pickup

    Physical and strategic theftCarriersBrokersShippers

    A stranger arrives with your pickup number and the dock lets them leave.

    What it looks like

    Someone who is not your carrier shows up at the dock with the pickup number, a plausible truck, and a story. Sometimes they carry a real carrier’s identity, sometimes a made-up one. Your real driver arrives later to an empty door. CargoNet counted 158 fictitious pickups in Q2 2026, against 165 in Q2 2025.

    What to do

    Give the warehouse a name, a truck number, and a callback. Tell them to hold the freight if those don’t match. Record the driver’s license, tractor and trailer plates, and USDOT/MC number.

    Full explanation, warning signs and every step

    How it works

    Using a real carrier's identity or a fake identity, someone gets a load assigned, then shows up and takes it. CargoNet counted fictitious pickups as a leading theft method: 158 in Q2 2026 versus 165 in Q2 2025. NICB lists fictitious pickups and fictitious carriers as a result of digital gaps in the supply chain.

    Warning signs

    • Driver and equipment details differ from what the carrier sent
    • Pickup details were changed shortly before arrival
    • The driver cannot reach dispatch on a number you can independently verify
    • The carrier's contact details were recently changed on its public record

    All the steps

    • Confirm the pickup with the carrier on a second channel (phone number from FMCSA or your own records)
    • Record the driver, license, tractor and trailer plates and USDOT/MC numbers
    • Do not release freight if anything does not match; call the broker or shipper first
    • If freight left, call local police right away and then follow the I got hit steps

    Sources

  7. Pattern 7

    Bought or hijacked MC and USDOT authority

    Identity and authority fraudCarriersBrokers

    A clean, old carrier record with a new owner behind it.

    What it looks like

    Criminals buy real carriers, with their clean history, through social media, marketplaces and specialized brokers, then use them for fraud. CargoNet warns that carriers who sell their authority, knowingly or not, may face civil and criminal liability. Watch for a new owner or address on an old record, or contacts, insurance and equipment all changing at once.

    What to do

    Never sell, buy or lease a USDOT or MC number. FMCSA says it will inactivate the number and revoke registrations. Look at a carrier’s recent changes in public records, not just its age, and re-verify after any sudden ownership or contact change.

    Full explanation, warning signs and every step

    How it works

    CargoNet reports that criminal networks are buying legitimate carriers through social media, peer-to-peer marketplaces and specialized brokerage services, and that existing carriers who sell authority to such networks, knowingly or not, may face civil and criminal liability. FMCSA says plainly: do not sell, purchase or lease USDOT or MC numbers; FMCSA will inactivate the USDOT number and revoke registrations. FreightWaves has reported on the underground market for MC numbers.

    Warning signs

    • A brand new owner or address on an old carrier record
    • Authority listed for sale on social media or marketplaces
    • A carrier whose contacts, insurance and equipment changed together
    • Offers to "lease" your MC number for cash

    All the steps

    • Never sell, buy or lease USDOT or MC numbers; equipment leasing under 49 CFR Part 376 is a different thing, so ask FMCSA if unsure
    • Look at a carrier's recent changes in public records, not just its age
    • Treat sudden ownership or contact changes as a reason to re-verify
    • Report offers to buy authority to FMCSA

    Sources

  8. Pattern 8

    Fake rate confirmations

    Fake loads and fake paperworkCarriers

    A rate confirmation with a real broker’s logo and a fake sender.

    What it looks like

    FreightWaves describes rate cons that carry a real broker’s name and MC number but come from a spoofed email, list an unofficial phone number, and give payment instructions the broker never issued. You haul the load and the payer disappears. The real broker has no record of the deal.

    What to do

    Don’t haul until you’ve confirmed. Look up the MC number on SAFER and match the name, address and phone. Call the broker’s main number from its website or the FMCSA record. Keep screenshots and emails, and report to FMCSA and the DOT Inspector General.

    Full explanation, warning signs and every step

    How it works

    FreightWaves describes rate cons that carry a real broker's logo and MC number but come from spoofed email addresses, list unofficial phone numbers, and carry payment instructions the broker never issued. Once the load is hauled, the scammer vanishes and the real broker has no record of the deal.

    Warning signs

    • Sender email is from a free provider or a misspelled domain
    • Phone number not on the broker's FMCSA profile or website
    • Rush language: "don't worry about the paperwork right now"
    • Name on the document does not match the FMCSA record for that MC number
    • Invoices or BOLs to be sent to a personal email, or payment to a personal account

    All the steps

    • Do not haul until confirmed
    • Look up the MC number on SAFER and match name, address and phone
    • Call the broker's main number from its website or FMCSA record
    • Keep screenshots and emails, and report to FMCSA and the DOT OIG

    Sources

  9. Pattern 9

    Fake broker or shipper that never pays

    Payment fraudCarriers

    A load that pays too well, from a broker with nothing behind it.

    What it looks like

    A rate far above market, no haggling, and pressure to pick up before the paperwork is checked. The broker’s authority may be missing or inactive, or have no bond or trust filing. FMCSA requires brokers to carry a $75,000 surety bond or trust fund, and surety and trust providers can pay claims from it.

    What to do

    Check the broker’s authority and bond or trust filing in Licensing & Insurance before pickup. Keep the rate con, BOL, proof of delivery and invoices. If you aren’t paid, file a claim with the surety or trust provider with proof of the debt, and report to FMCSA and the FTC.

    Full explanation, warning signs and every step

    How it works

    FMCSA's guidance on broker and carrier fraud says to stop the transaction if the broker quickly agrees to pay more than asked, or if the rate is far above market. Brokers are required to carry a $75,000 surety bond or trust fund with FMCSA; FMCSA's notices describe surety and trust providers paying claims from that security.

    Warning signs

    • A rate far above market and no haggling
    • Broker authority missing or not active in FMCSA records
    • No bond or trust filing shown for the broker
    • Pressure to pick up before paperwork is verified

    All the steps

    • Check broker authority and the bond/trust filing in FMCSA's Licensing & Insurance system
    • Keep the rate con, BOL, proof of delivery and invoices
    • File a claim with the broker's surety or trust provider with proof of the debt
    • Report to FMCSA, FTC and, if appropriate, local police

    Sources

  10. Pattern 10

    Factoring and payment-redirect scams

    Payment fraudCarriersBrokers

    A notice that says to send the money somewhere new.

    What it looks like

    A notice of assignment, or an “our bank details changed” message, arrives by email only. In real factoring, a properly notified customer generally must pay the factor, which is why a fake notice works. Watch for a factor you’ve never heard of, missing legal names or remittance details, and urgency.

    What to do

    Call the factor or customer on a number from its own website or your records before changing any payment detail. Ask for written acknowledgment. If money went to the wrong account, tell the factor, your bank and your insurer right away.

    Full explanation, warning signs and every step

    How it works

    In real freight factoring, a notice of assignment tells the customer to pay a factoring company instead of the carrier, and under the Uniform Commercial Code a properly notified customer generally must pay the factor. That makes a fake notice powerful. FreightWaves also notes that fraudulent rate cons may tell carriers to send invoices to an unknown factoring company or payment to a personal account, and that real brokers do not change payment routing outside their own systems.

    Warning signs

    • A notice of assignment or bank change arrives by email only
    • A factor you have never heard of, or one with a look-alike email domain
    • Missing legal names, contacts, effective date or remittance instructions
    • Invoices or BOLs requested at a personal email
    • Urgency to change payment details now

    All the steps

    • Confirm any assignment or payment change by calling the factor or customer on a number from its own website or your records
    • Ask for acknowledgment in writing and keep proof of delivery of notices
    • Never accept a payment-detail change from an email alone
    • Tell the factor, bank and your insurer right away if money went to the wrong account

    Sources

  11. Pattern 11

    Fake loads and spoofed load-board postings

    Fake loads and fake paperworkCarriersBrokers

    A load-board posting that exists to catch you, or to catch the load.

    What it looks like

    Criminals post fake loads to lure carriers, and bid on real loads they plan to double-broker or steal. The signs are a rate well above market, a blind load, contact only by text or a temporary number, and a company profile that doesn’t match FMCSA records.

    What to do

    Verify the poster’s MC or USDOT number and phone in SAFER. Skip blind loads. Confirm the load with the shipper directly before dispatching, and report fake postings to the load board and to FMCSA.

    Full explanation, warning signs and every step

    How it works

    The FBI's 2026 notice describes criminals who post fake loads on load boards, and who bid on real loads they intend to double-broker or steal, often with manipulated bills of lading. FMCSA's guidance also warns that top search results for a company can be fake profiles, so phone numbers should be confirmed through SAFER.

    Warning signs

    • Rates well above the market for the lane
    • Blind loads with no shipper or pickup details until you commit
    • Contact only by text or a temporary phone number
    • A posting whose company profile does not match FMCSA records

    All the steps

    • Verify the poster's MC or USDOT number and phone in SAFER
    • Do not take a blind load
    • Confirm the load with the shipper directly before dispatching
    • Report fake postings to the load board and to FMCSA

    Sources

  12. Pattern 12

    Phishing for load-board and email logins

    Email, phishing and account takeoverCarriersBrokers

    An unexpected link that wants you to sign in or install something.

    What it looks like

    The FBI describes spoofed brokers sending a link to a “carrier broker agreement,” and a “poor service review” link. Both can download remote monitoring software, which lets criminals impersonate the carrier or broker on load boards and in email.

    What to do

    Don’t click. Type the load board’s address yourself. Never install remote-access software for a stranger. Use multi-factor authentication and a unique password. If you clicked, disconnect, change passwords from a clean device, and report to IC3.

    Full explanation, warning signs and every step

    How it works

    The FBI describes two lures: spoofed brokers who send a link to a "carrier broker agreement," and a "poor service review" link. Both can download remote monitoring software. Criminals then use the access to impersonate the carrier or broker on load boards and in email.

    Warning signs

    • An unexpected agreement or review link
    • A request to install software to "view" a document
    • Login pages reached from an emailed link
    • Shortened or odd-looking links

    All the steps

    • Do not click; go to the load board or site by typing its address
    • Never install remote-access software for a stranger
    • Use multi-factor authentication and a unique password
    • If you clicked, disconnect, change passwords from a clean device, and report to IC3

    Sources

  13. Pattern 13

    Fake FMCSA, Motus and SAFER messages

    Email, phishing and account takeoverCarriersBrokers

    An email that says it’s FMCSA and wants money or a login.

    What it looks like

    FMCSA lists fake Motus portal emails, SAFER impersonation, fake audit and document requests, and fake Clearinghouse notices. FMCSA says it never asks for payment or sensitive information (UCR, PIN, SSN, EIN, bank details) in unsolicited messages. Its email almost always ends in @dot.gov.

    What to do

    Type motus.dot.gov yourself. Call FMCSA at 1-800-832-5660, or use its ticket form, to ask whether a message is real. Report fake FMCSA callers at reportfraud.ftc.gov. Don’t reply with documents or payment.

    Full explanation, warning signs and every step

    How it works

    FMCSA's fraud alerts list fake Motus portal emails, SAFER impersonation, fake audit requests, fake document requests for insurance and EIN, and fake Clearinghouse violation notices. FMCSA says it will never request payment or sensitive information (such as UCR, PIN, SSN, EIN, bank details) through unsolicited messages. The real Motus site is motus.dot.gov. FMCSA email almost always ends in @dot.gov.

    Warning signs

    • Sender address not at dot.gov
    • A deadline plus a link to "update" your registration
    • A request for money, a PIN, SSN or bank details
    • A caller who says they are from FMCSA and wants payment

    All the steps

    • Type motus.dot.gov yourself and log in there
    • Call FMCSA at 1-800-832-5660 or use the ticket form to ask if a message is real
    • Report telemarketers posing as FMCSA at reportfraud.ftc.gov
    • Do not reply with documents or payment

    Sources

  14. Pattern 14

    Fake or altered insurance certificates

    Fake loads and fake paperworkBrokersShippers

    A certificate that says covered when the record says otherwise.

    What it looks like

    FMCSA warns that even insurance certificates can be fraudulent. Watch for a certificate emailed from a free address, insurer or policy details that don’t check out, no filing in FMCSA’s records, a recent cancellation, or a name that doesn’t match the carrier’s legal name.

    What to do

    Look up the carrier in Licensing & Insurance and compare it to the certificate. Call the insurer or agent on a number you find yourself. Re-check before each load, because coverage can lapse.

    Full explanation, warning signs and every step

    How it works

    FMCSA's guidance notes that even insurance certificates can be fraudulent. FMCSA sets minimum financial-responsibility levels and keeps the required insurance filings on file for each carrier and broker, which gives you a way to check a certificate against an independent record.

    Warning signs

    • A certificate emailed from a free address
    • Policy numbers or insurer names that do not check out
    • No insurance filing in FMCSA's records, or a recent cancellation
    • Certificate details that do not match the carrier's legal name

    All the steps

    • Look up the carrier in FMCSA's Licensing & Insurance system and compare to the certificate
    • Call the insurer or agent on a number you find yourself
    • Re-check before each load; coverage can lapse

    Sources

  15. Pattern 15

    Counterfeit rate confirmations and bills of lading

    Fake loads and fake paperworkCarriersBrokersShippers

    Paperwork where the carrier’s ID code doesn’t match the carrier.

    What it looks like

    NMFTA says counterfeit rate confirmations and fraudulent bills of lading are prevalent in theft and double-brokering schemes, and a mismatched SCAC is an early warning sign. The FBI points to manipulated BOLs when criminals bid on real loads. Look for details that differ between the rate con, BOL and pickup number, paperwork from a third party, or a last-minute BOL change.

    What to do

    Compare the carrier code, legal name and USDOT/MC number on every document. Confirm any change directly with the shipper, and keep a copy of every version.

    Full explanation, warning signs and every step

    How it works

    NMFTA says counterfeit rate confirmations and fraudulent bills of lading are prevalent in theft and double brokering schemes, and that a mismatch in the carrier's SCAC (Standard Carrier Alpha Code) is an early warning sign. The FBI also points to manipulated BOLs in schemes where criminals bid on real loads.

    Warning signs

    • A different carrier code on the BOL than the one booked
    • Details that differ between the rate con, BOL and pickup number
    • Documents that arrive from a third party rather than the booked party
    • A last-minute BOL change

    All the steps

    • Compare the carrier code, legal name and USDOT/MC across every document
    • Check the carrier's identity-verified status where available
    • Confirm any change directly with the shipper
    • Keep copies of every version of the paperwork

    Sources

  16. Pattern 16

    VoIP numbers and synthetic identities

    Identity and authority fraudCarriersBrokersShippers

    A contact who only exists on an app-based phone number.

    What it looks like

    NICB says criminals use VoIP apps to pick any area code, plus fictitious email accounts and altered DOT records, to impersonate companies and reroute freight. Synthetic identities mix real and fake details built from stolen data. Watch for contacts who answer only on app numbers, numbers that don’t match SAFER, and free or brand-new email addresses.

    What to do

    Check phone numbers against FMCSA records, add extra vetting when a number turns out to be VoIP, and call back on a number you already trust.

    Full explanation, warning signs and every step

    How it works

    NICB says criminals use VoIP apps to pick any area code, fictitious email accounts and altered DOT records to impersonate companies and reroute freight. Synthetic identities, mixes of real and fake identifiers built from stolen data, add another layer.

    Warning signs

    • A contact who answers only on an app-based number
    • Phone numbers that do not match the SAFER record
    • Email addresses that are free or new
    • Details that cannot be verified anywhere public

    All the steps

    • Verify numbers against FMCSA records
    • Add extra vetting when a number turns out to be VoIP
    • Use a call-back to a known number, not the one in the message

    Sources

  17. Pattern 17

    GPS jamming and defeated trackers

    Physical and strategic theftCarriersShippers

    The tracker goes quiet right after pickup.

    What it looks like

    NICB says its agents have confirmed seizures of GPS jammers in cargo theft cases, and that thieves often disable trackers that aren’t well hidden. Watch for a tracker that goes silent where it should have signal, door or telematics events with no matching driver activity, or a trailer that stops reporting right after pickup.

    What to do

    Use more than one tracker and hide them well. Alert on signal loss, not only on movement. Call the driver and dispatch the moment a device goes dark, and ask police for a case number.

    Full explanation, warning signs and every step

    How it works

    NICB reports that its agents have confirmed seizures of GPS jammers in cargo theft cases, and that thieves frequently disable trackers that are not well hidden. NICB lists GPS jamming alongside VoIP, synthetic IDs and phishing as technology used to commit cargo theft.

    Warning signs

    • A tracker that goes silent in a stretch where it should have signal
    • Door or telematics events with no matching driver activity
    • A trailer that stops reporting right after pickup

    All the steps

    • Use more than one tracking device and hide them well
    • Set alerts for signal loss, not only for movement
    • Call the driver and dispatch the moment a device goes dark
    • Report theft quickly and ask police for a case number

    Sources

  18. Pattern 18

    Food, metals and tech: targeted commodities

    Physical and strategic theftCarriersShippers

    The load is easy to resell, so it gets picked first.

    What it looks like

    CargoNet’s 2025 analysis counted 708 food and beverage thefts (up 47%), said metal theft rose 77% on copper, and named enterprise computing and crypto-mining hardware top-tier targets. In Q2 2026, metal theft events rose from 54 to 80.

    What to do

    Apply extra verification for these commodities. Avoid drop-and-hook staging for high-value loads where you can, and use live, covert tracking and secured parking.

    Full explanation, warning signs and every step

    How it works

    CargoNet's 2025 analysis counted 708 food and beverage thefts, up 47%, with meat, seafood and tree nuts heavily targeted, and said metal theft rose 77%, driven by copper. Enterprise computing components and cryptocurrency mining hardware emerged as top-tier targets. In Q2 2026, metal theft events rose from 54 to 80, with copper most targeted, and seafood rose by 11 events.

    Warning signs

    • A pickup for a high-value commodity from a carrier new to you
    • A request to move the load unusually fast or in an unusual way
    • Little interest in price negotiation

    All the steps

    • Apply extra verification for the commodities in the tracker
    • Avoid drop-and-hook staging for high-value loads where you can
    • Use live, covert tracking and secured parking

    Sources

  19. Pattern 19

    Rail, yard and overnight-parking theft

    Physical and strategic theftCarriersShippers

    A loaded truck or trailer is easiest to take when it’s sitting still.

    What it looks like

    NICB says railway theft is rising and that trucks and cargo are most vulnerable when idle. Thieves often wait outside known shipping facilities for drivers to stop. Watch for loaded trailers left overnight in unsecured spots, vehicles that seem to follow a truck, and repeated stops at the same unsecured place.

    What to do

    Park only in known secure locations, and avoid stopping in the first 200 miles after pickup when you can. Avoid known hot spots. Use immobilizers and cargo seals, and good visibility at your yard.

    Full explanation, warning signs and every step

    How it works

    NICB says railway theft is on the rise, with organized groups taking cargo from trains or rail yards in transit or in storage, and that trucks and cargo are most vulnerable when idle. NICB notes thieves often wait outside known shipping facilities for drivers to stop.

    Warning signs

    • Loaded trailers left overnight in unsecured spots
    • Vehicles that seem to follow a truck from the shipper
    • A pattern of stops at the same unsecured location

    All the steps

    • Avoid stopping in the first 200 miles after pickup when you can, and park only in known secure locations
    • Avoid known hot spots
    • Use countersurveillance and 360-degree visibility at your yard
    • Use immobilizers and cargo seals

    Sources

  20. Pattern 20

    Insider and driver collusion

    Physical and strategic theftCarriersShippers

    Someone on the inside tells the thieves where the load is.

    What it looks like

    NICB notes cargo theft can include an inside informant who follows the goods and helps criminals dispose of them quickly. The FBI also describes freight cross-docked or transloaded to complicit drivers. Watch for unexpected cross-dock requests, load details leaking outside the chain, and drivers who avoid check-ins.

    What to do

    Limit who sees load details, screen staff who handle shipping information, and train drivers to spot and report theft. Report suspected insiders to law enforcement.

    Full explanation, warning signs and every step

    How it works

    NICB notes that cargo theft can include an inside informant who follows the goods and leads criminals to quickly dispose of the cargo. The FBI also describes schemes where freight is cross-docked or transloaded to complicit drivers.

    Warning signs

    • Unexpected cross-dock or transload requests
    • Shipment details leaked to people outside the chain
    • A driver who departs from the plan or avoids check-ins

    All the steps

    • Screen employees, especially those with shipping information
    • Train drivers and staff to spot theft and report it
    • Limit who sees load details
    • Report suspected insiders to law enforcement

    Sources

  21. Pattern 21

    Shortening loads and pilferage

    Physical and strategic theftCarriersShippers

    The seal is intact and the count is wrong.

    What it looks like

    NICB describes “shortening loads”: thieves take only part of the cargo so the rest looks undisturbed, and it often goes unnoticed until the driver reaches the destination. Watch for a delivery count that doesn’t match the loading count, or a trailer opened for a brief stop.

    What to do

    Count and photograph at pickup, and sign with exceptions noted. Use security seals and record their numbers. Inspect and count before you sign the delivery paperwork.

    Full explanation, warning signs and every step

    How it works

    NICB describes "shortening loads," where thieves take only a portion of the cargo. Removing selected pieces keeps the theft quiet, and it often goes unnoticed until the driver reaches the destination.

    Warning signs

    • Seal intact but count off at delivery
    • A trailer opened for a brief stop
    • A mismatch between loading count and delivery count

    All the steps

    • Count and photograph at pickup and sign with exceptions noted
    • Use advanced security seals and record their numbers
    • Inspect and count before the delivery paperwork is signed

    Sources

These describe how schemes work in general. They never accuse a specific company. Every card lists the public sources it is built from. The “What it looks like” and “What to do” summaries are our plain-English reading of those sources.