# Email security for trucking and logistics companies: stopping cyber-enabled freight fraud

URL: https://iblockspam.com/blog/email-security-for-trucking-logistics-companies
Last updated: 2026-10-16
Published: 2026-10-16
Topic: Phishing & threats
Author: iBlockSpam Team

> Email risks for carriers, brokers and 3PLs: fake broker emails that install remote access tools, load board takeover, FMCSA phishing and cargo theft.

## Short answer

Trucking and logistics companies are targeted because emails decide who picks up a load, where it goes and who gets paid. The FBI warns of phishing that impersonates brokers to install remote access software, then takes over carrier accounts to steal freight. Use MFA, block unapproved remote tools, verify pickups and payment changes by phone, and publish DMARC.

Freight moves on email. Rate confirmations, carrier packets, bills of lading, pickup numbers and remit-to details pass between shippers, brokers, carriers and dispatchers all day, often read on a phone in a cab or at a dock. Criminals have learned that a few well-timed emails can steal an entire load. This guide explains the email threats specific to trucking and logistics, what the FBI and FMCSA have published about them, and a checklist for dispatch, accounting and safety staff.

## Why are trucking and logistics companies targeted by email?

Trucking and logistics companies are targeted because emails decide who picks up a load, where it goes and who gets paid, between parties who often have never met. A single load can involve a shipper, a freight broker, a carrier, a driver and a factoring company, each confirming details by email or load board messages. Every handoff is a chance for an impostor.

The FBI described this in an April 2026 public service announcement, [Cyber-Enabled Strategic Cargo Theft Surging](https://www.ic3.gov/PSA/2026/PSA260430). It says that since at least 2024, criminals have reached broker and carrier systems through "spoofed emails, fake URLs, and compromised carrier accounts". The FBI's figures are stark: "In 2025, estimated cargo theft losses in the United States and Canada surged to nearly $725 million", a 60 percent rise from 2024, "while confirmed cargo theft incidents increased by 18 percent." The average value per theft rose 36 percent to $273,990.

Payment fraud is the other big risk. The FBI's Internet Crime Complaint Center (IC3) recorded 24,768 business email compromise (BEC) complaints in 2025, with $3,046,598,558 in reported losses across all industries ([IC3 2025 report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)). **BEC** is fraud where a criminal impersonates, or takes over, a trusted email account to redirect money. In freight, that often means a fake change to where a carrier or broker gets paid.

## How does cyber-enabled cargo theft work?

Cyber-enabled cargo theft starts with a phishing email and ends with a stolen load. Based on the FBI's April 2026 PSA, the typical sequence is:

1. **The lure.** A phishing email impersonates a broker and asks the carrier to open a carrier-broker agreement or respond to poor service ratings. The links are often shortened or spoofed.
2. **The install.** The link leads to a fake site hosting a malicious file, which installs legitimate remote monitoring and management (RMM) software. **RMM software** is the remote-control tool IT support companies use, which is why it can run unnoticed.
3. **The takeover.** With hidden access, criminals take over the carrier's or broker's accounts, including email and load boards.
4. **The fake loads.** From compromised broker accounts, they post fake loads on load boards, "sometimes in the tens of thousands", to collect bids and lure more carriers.
5. **The theft.** Posing as the compromised carrier, they accept real loads, double-broker them to partially unwitting drivers with manipulated bills of lading, and change the destination. The cargo is cross-docked or transloaded and resold.
6. **The cover.** They change the real carrier's contact details with the Federal Motor Carrier Safety Administration (FMCSA) and update insurance information, and may demand ransom for the load's location.

Here's an example of the kind of lure to treat with suspicion:

> Example: "Hello, we received 2 service complaints on your last loads with us and your carrier rating is under review. Please review and sign the updated carrier-broker agreement here before we can tender further freight."

The FBI also shows how the sender addresses look. Criminals use free email providers with lookalike names, such as "dispatch.FBITrucking@[provider].com instead of dispatch@FBITrucking.com". That's one reason to send all business email from your own domain: partners learn that anything else isn't you.

## What email scams target carriers, brokers and shippers?

Beyond cargo theft, freight companies see several recurring email scams. The table lists them with the check that stops each.

| Scam | What arrives | Who it targets | How to check |
|---|---|---|---|
| Fake broker agreement or rating email | A link to "sign" an agreement or "review complaints" | Carrier dispatch, owner-operators | Log in to the broker's portal yourself; never run downloaded files |
| Fake FMCSA or registration notice | "Update your registration" or "verify your USDOT account" | Carrier owners, safety and compliance staff | Type the FMCSA address yourself; call FMCSA |
| Fake pickup or destination change | "Consignee changed, deliver to this warehouse instead" | Dispatch, drivers | Call the broker or shipper on a known number |
| Remit-to or bank change | "Our factoring company changed, send payment here" | Broker and shipper accounts payable | Call the carrier on a number from the original carrier packet |
| Load board account phishing | A fake load board sign-in page | Brokers, dispatchers | Use bookmarks; turn on MFA where offered |
| Fuel card or payroll diversion | A driver "asks" to change direct deposit or fuel card details | Payroll, fleet admin | Confirm in person or by a known number |

### FMCSA impersonation

FMCSA has issued repeated warnings about phishing that impersonates it. Its [fraud alerts page](https://www.fmcsa.dot.gov/registration/fraud-alerts) describes fake notices, spoofed copies of its portal and emails with fake headers that ask for your SSN and USDOT PIN. Real FMCSA websites end in .gov. FMCSA says it "will never request Social Security numbers, bank account details, or credit card information via unsolicited emails or phone calls" ([FMCSA phishing alert](https://www.fmcsa.dot.gov/newsroom/alert-recent-phishing-scheme-targets-motor-carriers)). Because the FBI says criminals change FMCSA contact details after stealing a carrier's identity, a stolen FMCSA login is as dangerous as a stolen email password. FMCSA's [broker and carrier fraud page](https://www.fmcsa.dot.gov/mission/help/broker-and-carrier-fraud-and-identity-theft) lists where to report fraud and identity theft, including someone using your USDOT number without permission.

### Payment redirection

A remit-to change is the freight version of [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection). The FBI advises using "secondary channels and/or two-factor authentication to verify requests for changes in account information" ([IC3 PSA I-091124-PSA](https://www.ic3.gov/PSA/2024/PSA240911)). Brokers should confirm any change to a carrier's payee or factoring company by calling the carrier on the number in the original carrier packet, never one in the email.

## How do you stop freight fraud that starts by email?

Stop freight fraud by making verification independent of email and by blocking the remote access tools the attacks rely on. The FBI's recommendations include: "Independently verify shipment requests and pickups using secondary methods prior to releasing any loads", using multi-channel verification, not relying on familiar names or addresses, and keeping thorough documentation of drivers, vehicles, plates, DOT and MC numbers. For a carrier or broker, that becomes:

1. **Verify every pickup and destination change** by calling a known contact at the broker or shipper. Treat a mid-route consignee change by email as unconfirmed.
2. **Never run a file from an agreement or ratings email.** Real agreements are signed in a portal or an e-signature service you reach yourself. See [fake DocuSign and e-signature phishing](https://iblockspam.com/blog/fake-docusign-e-signature-phishing).
3. **Block unapproved remote access software.** Ask your IT provider to allow only the remote tool you actually use and alert on any new one.
4. **Turn on MFA** for email, load boards, the FMCSA portal, TMS and banking. CISA's joint [phishing guidance](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf) recommends FIDO-based or other phishing-resistant MFA, prioritized for privileged accounts such as those with broad access to customer or financial data.
5. **Check mailboxes for new rules.** The FBI lists "new or unauthorized mailbox rules (for example, forwarding to external addresses, autodeletion, or hidden folders)" as a red flag. See [malicious inbox rules](https://iblockspam.com/blog/malicious-inbox-rules-auto-forwarding).
6. **Document every party** on a load, including driver photos, licenses, truck and trailer plates, and DOT and MC numbers.
7. **If freight or money is stolen**, file a police report for the cargo, call your bank for a recall, and file at [ic3.gov](https://www.ic3.gov) or with your local FBI field office.

## How do you protect dispatchers and drivers on the road?

Protect dispatchers and drivers by giving each person their own company account with MFA and by managing the phones they read email on. Shared logins such as `dispatch@` used by several people with one password are common in trucking. They can't use per-person MFA, and nobody can tell who approved a change. Use a shared mailbox that each dispatcher opens with their own account instead; see [shared mailbox spam protection](https://iblockspam.com/blog/shared-mailbox-spam-protection).

Drivers read rate confirmations and pickup instructions on small screens, where only the display name may show. Teach them to check the full address and to call dispatch before acting on any change. If a company phone is lost at a truck stop, you should be able to sign it out and wipe company data remotely. Our guide to [mobile email security and BYOD](https://iblockspam.com/blog/mobile-email-security-byod) covers the settings, and [employee offboarding](https://iblockspam.com/blog/employee-offboarding-email-security) covers driver turnover.

## Is Microsoft 365 or Google Workspace security enough for a trucking company?

For a small carrier or broker, Microsoft 365 or Google Workspace with MFA enforced, external sender tags and attachment protections turned on is a reasonable baseline. Review those settings first. Our guides to [Microsoft 365 Safe Links and Safe Attachments](https://iblockspam.com/blog/microsoft-365-safe-links-safe-attachments) and [Google Workspace advanced phishing and malware protection](https://iblockspam.com/blog/google-workspace-advanced-phishing-malware-protection) explain what each platform offers at the time of writing (October 2026). For the general case, see [do you need a spam filter with Microsoft 365?](https://iblockspam.com/blog/do-i-need-a-spam-filter-with-microsoft-365).

An MX-level filter adds an independent check before mail reaches dispatch. **MX records** are the DNS entries that tell the internet where to deliver your domain's mail; pointing them at a filtering service means it checks every message first. That helps a freight company when:

- broker-themed phishing keeps reaching dispatchers and owner-operators
- you want to block executable and other risky attachment types, plus Office macros, from outside senders
- you want geographic filters for regions you never do business with
- you want mail held for up to 5 days, not bounced, if your mail server goes down during a busy week

No filter stops a criminal who has already taken over a real broker's mailbox, so the phone call stays essential. iBlockSpam prices [per domain rather than per user](https://iblockspam.com/solutions/small-business), so adding drivers and seasonal dispatchers doesn't change the bill.

## How do you stop criminals impersonating your company's domain?

Publish SPF, DKIM and DMARC so that mail faking your exact domain fails authentication. **DMARC** is a DNS record telling receivers what to do with mail that claims to be from your domain but fails SPF and DKIM. Include your TMS and any service that sends rate confirmations or invoices for you. A record at enforcement looks like this example:

```
_dmarc.example-freight.com  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example-freight.com"
```

CISA's phishing guidance asks organizations to "ensure DMARC is set to 'reject' for sent emails". Our [DMARC from none to reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business) explains the steps. DMARC doesn't block lookalike domains or free-mail addresses using your name, so tell brokers and shippers which addresses you send from. See [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).

## Trucking and logistics email security checklist

1. Send all business email from your company domain, and tell partners you never use free email addresses.
2. Turn on MFA for email, load boards, the FMCSA portal, your TMS and banking.
3. Write down your verification rule: every pickup change, destination change and remit-to change gets a call to a known number.
4. Block unapproved remote access software and alert when a new one appears.
5. Block risky attachment types and Office macros from outside senders. See [dangerous email attachment types](https://iblockspam.com/blog/dangerous-email-attachment-types).
6. Replace shared dispatch logins with personal accounts on a shared mailbox.
7. Check mailboxes weekly for forwarding, deletion and hidden-folder rules.
8. Publish SPF, DKIM and DMARC, and move DMARC to enforcement.
9. Check your FMCSA registration details regularly so you'd notice an unauthorized change.
10. Brief dispatchers and drivers on fake broker agreements, rating complaints and FMCSA emails.

## Next steps

- Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your company's domain to see your MX, SPF and DMARC setup.
- Read the FBI's [cargo theft PSA](https://www.ic3.gov/PSA/2026/PSA260430) with your dispatch and accounting leads, and agree your call-back rule.
- Review the wider basics in the [small business email security checklist](https://iblockspam.com/blog/email-security-checklist-small-business).
- If you want a filtering layer in front of your mailboxes, see how iBlockSpam works for [small businesses](https://iblockspam.com/solutions/small-business). Unlimited mailboxes means mailbox count, not message volume: each domain includes 100,000 inbound messages a month.

More threat guides are in our [phishing and threats topic](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### How do criminals use email to steal freight?

The FBI says criminals send phishing emails impersonating brokers, with links to a carrier-broker agreement or a complaint about service ratings. The link installs remote monitoring software that gives them access. They then use the carrier's accounts to accept real loads, double-broker them, change the destination and resell the cargo, sometimes demanding ransom for its location.

### How much was lost to cargo theft in 2025?

The FBI said estimated cargo theft losses in the United States and Canada reached nearly $725 million in 2025, a 60 percent increase from 2024. Confirmed incidents rose 18 percent, and the average value per theft rose 36 percent to $273,990, according to its April 2026 public service announcement on cyber-enabled cargo theft.

### Are emails from FMCSA asking me to update my registration real?

Be careful. FMCSA has issued repeated fraud alerts about phishing emails and fake websites that impersonate it, including spoofed copies of its registration portal. FMCSA says it will never request Social Security numbers, bank account details or credit card information through unsolicited emails or calls. Go to FMCSA's site by typing the address yourself.

### What is double brokering in freight fraud?

Double brokering is when someone accepts a load and then re-brokers it to another carrier without the shipper's or original broker's permission. In cyber-enabled schemes the FBI describes, criminals using a compromised carrier's identity double-broker loads to partially unwitting drivers with manipulated bills of lading, then redirect the freight.

### Should truck drivers have company email accounts?

Anyone who receives rate confirmations, bills of lading or pickup instructions should use a company account with MFA, not a personal free address. The FBI notes criminals use free email addresses that resemble a carrier's real dispatch address, which is easier to spot when your company always uses its own domain. Drivers who only need schedules may not need full mailboxes.

## Sources

- [FBI IC3 PSA I-043026-PSA: Cyber-Enabled Strategic Cargo Theft Surging (April 30, 2026)](https://www.ic3.gov/PSA/2026/PSA260430)
- [FMCSA: Fraud Alerts](https://www.fmcsa.dot.gov/registration/fraud-alerts)
- [FMCSA: ALERT! Recent Phishing Scheme Targets Motor Carriers](https://www.fmcsa.dot.gov/newsroom/alert-recent-phishing-scheme-targets-motor-carriers)
- [FMCSA: Broker and Carrier Fraud and Identity Theft](https://www.fmcsa.dot.gov/mission/help/broker-and-carrier-fraud-and-identity-theft)
- [FBI Internet Crime Complaint Center: 2025 IC3 Annual Report (PDF)](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [FBI IC3 PSA I-091124-PSA: Business Email Compromise, The $55 Billion Scam (September 2024)](https://www.ic3.gov/PSA/2024/PSA240911)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance, Stopping the Attack Cycle at Phase One](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-trucking-logistics-companies (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt