How Does Business Email Compromise Lead to Stolen Freight?

Business email compromise can turn a legitimate freight workflow into cargo theft when criminals control or imitate trusted email accounts and change shipment instructions.

Business Email Compromise: Freight-Specific Warning Signs

Last reviewed: October 2026. This article is educational information, not cybersecurity or legal advice.

What is business email compromise?

The FBI describes business email compromise, or BEC, as one of the most financially damaging online crimes. In a BEC scam, criminals send or control messages that appear to come from a trusted source and use that trust to obtain money, information, account access, or another valuable action.

In freight, the valuable action may not be a wire transfer. It may be releasing a trailer, accepting a new driver, changing a pickup time, resetting a password, updating bank information, or redirecting a shipment.

How does BEC turn into cargo theft?

The attack works because transportation companies depend heavily on email. Load tenders, rate confirmations, carrier packets, driver information, pickup numbers, delivery appointments, payment instructions, and customer updates often move through email threads. If a criminal can read or imitate those messages, the criminal can insert believable instructions into the freight workflow.

What did the FBI warn about in 2026?

The FBI’s April 2026 IC3 alert warned that cyber threat actors are increasingly compromising broker and carrier systems and using those accounts to impersonate legitimate businesses, post fraudulent loads, bid on real loads, double-broker shipments, manipulate bills of lading, and redirect cargo.

The FBI said these actors often gain access through spoofed emails, fake URLs, malicious downloads, and remote monitoring software.

How do criminals gain access to freight email accounts?

• Phishing emails
• Fake broker-carrier agreement links
• Fake service-review complaints
• Credential-harvesting websites
• Malicious attachments
• Remote monitoring and management software
• Password reuse
• Stolen session cookies
• Weak or missing multi-factor authentication

Once the attacker has account access, the criminal may watch quietly before acting. Waiting allows the attacker to learn who approves loads, how payment changes are handled, which customers ship high-value freight, and how employees write normal messages.

What is email spoofing?

Spoofing is when a criminal disguises an email address, sender name, phone number, or web address so it appears to belong to a trusted person or company. The FBI warns that small changes—one letter, extra punctuation, a different top-level domain, or a name inserted before a legitimate address—can fool users.

A spoofed email does not require the real mailbox to be compromised. It relies on visual similarity and urgency.

What is an actual account takeover?

An account takeover occurs when the attacker controls the real account. That is more dangerous because messages can come from the legitimate domain and existing email thread. The attacker can also search old correspondence, identify customer habits, and create forwarding or deletion rules to hide responses.

Why are forwarding rules a warning sign?

The FBI has documented BEC schemes where criminals create unauthorized mailbox rules that automatically forward messages, hide replies, delete alerts, or move emails into folders the user rarely checks. These rules can let an attacker monitor conversations and suppress evidence that something is wrong.

How can BEC change a freight pickup?

An attacker who controls a broker or carrier account can send a message changing the driver, tractor, trailer, pickup time, or carrier contact. Because the email appears familiar, the shipper may accept the change without secondary verification.

The criminal can then send an unauthorized truck to pick up the freight or send a legitimate driver acting on false instructions.

How can BEC change the delivery destination?

Destination changes are especially dangerous because the load may already be in transit. A compromised email account can send a believable message directing the driver to a different warehouse, cross-dock, or receiver. If the driver follows the instruction without a second-channel call-back, the freight can be delivered directly into a theft network.

How can BEC affect load boards?

The FBI says criminals can use compromised broker or carrier accounts to post fake loads and bid on real loads. A stolen account creates credibility because the company’s real name and history appear to support the transaction.

Threat actors may then use fake carrier packets or malicious links to compromise more companies, expanding the scheme.

How can BEC affect payments?

Classic BEC often involves changing bank or wire instructions. In freight, criminals may alter factoring information, quick-pay details, remittance accounts, or carrier payment instructions. The FBI specifically advises companies to verify any change in account number or payment procedures through a trusted secondary method.

What freight email red flags should employees watch for?

• Unexpected password or login prompts
• Shortened links
• Domains with one-character changes
• Free email addresses mimicking company identities
• Requests to download a new carrier packet
• Messages about negative service reviews with a login link
• Urgent destination changes
• Unexpected driver substitutions
• New banking instructions
• Unfamiliar mailbox forwarding rules
• Messages asking employees to disable MFA
• Requests that bypass normal approval channels

Why urgency is such a common tactic

Freight operations move quickly. A message saying “driver changed,” “shipper closes in 30 minutes,” or “use this new address immediately” creates pressure to skip normal controls. Attackers exploit the same urgency that legitimate logistics teams deal with every day.

A strong process makes verification faster than improvisation.

What should require a call-back?

• Driver changes
• Tractor or trailer changes
• Pickup-time changes on high-value loads
• Destination changes
• Bank-account changes
• Factoring-company changes
• Password-reset requests
• Requests for sensitive driver documents

The call-back should use a previously known number or authoritative source—not the phone number contained in the suspicious email.

Why multi-factor authentication matters

The FBI recommends multi-factor authentication on accounts that support it. MFA makes a stolen password less useful because the attacker needs an additional authentication factor.

Companies should also train employees never to approve unexpected MFA prompts and never to give one-time authentication codes to callers.

How should broker email accounts be segmented?

Not every employee needs access to customer payment data, load-board administration, carrier onboarding, and company-wide inboxes. Limiting privileges reduces the damage one compromised account can cause. Administrative accounts should be used only when needed.

What should companies do with former employee accounts?

Disable access immediately during offboarding. Remove email, TMS, load-board, bank, factoring, CRM, and shared-account permissions. Former accounts that remain active can be used for months without attracting attention.

How does driver verification reduce BEC risk?

Driver verification creates a physical-world check on digital instructions. Even if an email account is compromised, the shipper can compare the person and equipment that arrive with the driver and truck record approved for the load.

CargoGuard’s driver verification workflow can help tie driver identity and equipment information to the shipment rather than trusting email alone.

How do geofenced photos help?

Geofenced photo verification can preserve equipment photos near pickup. If an attacker sends a fake driver substitution by email, the physical pickup record can reveal that the truck does not match the approved shipment.

How should destination changes be approved?

High-risk destination changes should require multi-channel verification. Confirm the request through a trusted contact, document who approved it, and update the driver and receiver through controlled channels. A single email should not be enough to redirect valuable freight.

Scenario 1: fake broker packet link

A carrier receives an email from what appears to be a broker asking it to download a carrier agreement. The link installs remote monitoring software. The attacker later uses the carrier’s system and accounts to impersonate the company and bid on high-value loads.

Scenario 2: real broker mailbox is compromised

The attacker reads email for several days and identifies a high-value electronics shipment. On pickup morning, the attacker sends the shipper a driver-change email from the real broker account. The shipper releases the load because the message appears legitimate. A separate driver-verification process could expose the mismatch.

Scenario 3: fake factoring change

An attacker enters a carrier’s mailbox and sends the broker new remittance instructions. The broker changes the bank account without call-back verification and pays the criminal. Payment-change procedures should require an independently verified secondary channel.

Scenario 4: hidden forwarding rule

An attacker creates a rule that forwards customer emails externally and deletes password alerts. The employee continues using email normally while the criminal monitors high-value shipments. Periodic mailbox-rule reviews can uncover this type of persistence.

What should a company do after discovering BEC?

• Secure the affected email account.
• Reset passwords and revoke active sessions.
• Review MFA methods.
• Remove malicious forwarding rules.
• Review load-board and TMS access.
• Identify shipments exposed during the compromise.
• Verify pending pickups and destination changes.
• Contact the financial institution if money was sent.
• Preserve logs and messages.
• File an IC3 complaint.
• Notify law enforcement, insurers, and counsel as appropriate.

What should happen to active loads during an email compromise?

Identify every active or upcoming shipment the compromised account touched. Re-verify the carrier, driver, equipment, pickup time, and destination through trusted channels. High-value loads may need to be placed on temporary hold until instructions are confirmed.

How should employees be trained?

• Hover over links before clicking.
• Check full sender addresses.
• Do not install software from carrier packets.
• Report unexpected MFA prompts.
• Verify financial changes by phone.
• Verify shipment changes through a second channel.
• Report suspicious mailbox rules.
• Use unique passwords.

Frequently asked questions

Can one compromised email account lead to stolen cargo?

Yes. A compromised account can expose shipment details and allow criminals to impersonate trusted parties, redirect loads, or change pickup instructions.

Does MFA eliminate BEC?

No, but it makes account takeover harder. Attackers can still use phishing, session theft, social engineering, or user-approved MFA prompts.

Should destination changes be accepted by email?

High-risk destination changes should be independently verified through a second trusted channel.

Where should BEC be reported?

The FBI directs victims to IC3.gov and recommends contacting the financial institution immediately if funds were sent.

What readers should remember

Business email compromise can steal freight without ever breaking into a truck. Criminals use trusted email identities to alter the instructions that control pickup, delivery, load-board access, and payments. The strongest defense is layered: MFA, phishing resistance, limited account privileges, call-back verification, driver and equipment checks, and rapid incident response.

Bottom line

Email is now part of cargo security. If a company relies on email as the only proof that a driver, destination, or payment change is legitimate, one compromised mailbox can override the entire freight-security process. Treat important changes as transactions that require independent verification, not just messages that need a quick reply.

Why logistics email accounts are unusually valuable

A freight mailbox can contain more than conversation. It can reveal customer names, load values, lane history, driver contacts, pickup numbers, invoices, payment details, carrier packets, and login-reset links. One compromised mailbox can therefore expose operational, financial, and security information at the same time.

This concentration of information is why email compromise can lead directly to physical cargo theft.

What attackers do after gaining access

• Search for high-value loads.
• Read existing customer threads.
• Identify who approves changes.
• Create mailbox forwarding rules.
• Hide security alerts.
• Reset passwords to related systems.
• Impersonate dispatchers.
• Change payment instructions.
• Redirect active shipments.

Why thread hijacking is effective

An attacker replying inside a real email thread inherits the context, subject line, signatures, and history of a legitimate conversation. The recipient may see familiar names and assume the new instruction is authentic. This is more convincing than a completely new phishing message.

How to protect shared dispatch inboxes

• Require MFA for every user.
• Use named accounts rather than shared passwords where possible.
• Review mailbox forwarding rules.
• Limit who can create external forwarding.
• Monitor unusual login locations.
• Remove former users quickly.
• Separate administrative privileges from daily dispatch use.

How to protect carrier onboarding emails

Carrier onboarding is a common phishing opportunity because employees expect documents and links. Use a known onboarding portal when possible, scan attachments, avoid installing software from emailed packets, and verify unexpected links through a separate channel.

The FBI specifically warned about fake carrier-broker agreements and fake negative-review links used to compromise transportation companies.

How to protect payment-change requests

Never change a bank account, factoring company, or remittance instruction based only on email. Call a known company contact using a previously verified number and document who confirmed the change. For large payments, consider dual approval.

How to protect driver-change requests

A driver change should update the shipment record, not just the email thread. Confirm the change through the carrier and send the new approved driver and equipment information to the shipper. This gives the physical pickup process an independent source of truth.

How to protect destination changes

Require a second-channel verification for any material destination change, particularly after pickup. The driver should know that a new address received by email or text is not enough on a theft-sensitive load.

How to recognize a look-alike domain

Attackers may add a letter, replace a character, add punctuation, change .com to another top-level domain, or insert a word before the legitimate domain. Employees should check the full address rather than the display name.

Why DMARC, SPF, and DKIM matter

Email authentication controls can reduce certain forms of spoofing and help receiving systems identify unauthorized senders. They are not a complete defense against compromised real accounts, but companies should configure them properly as part of a broader email-security program.

Why password managers help

Password managers encourage unique passwords and can reduce credential reuse. They also make it easier for users to notice when a login page is on the wrong domain because the password manager may not autofill on a fake site.

Why session security matters

Attackers can sometimes steal browser sessions and bypass the need to enter a password again. Security teams should be able to revoke active sessions after suspected compromise and should review suspicious devices and login locations.

What should a freight-specific BEC incident plan include?

• Email security contact
• TMS administrator
• Load-board administrator
• Banking contact
• Carrier-sales lead
• High-value shipment list
• Customer escalation contacts
• Process to re-verify active loads
• IC3 reporting procedure
• Evidence-preservation steps

Why every active load must be reviewed after compromise

If an attacker had access to a dispatcher or broker mailbox, assume the attacker may have seen shipment details. Review upcoming pickups, active in-transit loads, destination changes, driver substitutions, and payment changes associated with that account. High-value loads may need immediate re-verification.

What evidence should be preserved?

• Original emails with headers
• Login records
• Mailbox rules
• MFA logs
• TMS audit logs
• Load-board activity
• Rate confirmations
• Driver and equipment records
• Banking changes
• Tracking history

How to reduce the blast radius of one compromised account

Use least-privilege access. A carrier-sales user should not automatically have authority to change company banking. A billing user should not automatically administer load-board accounts. Separating responsibilities limits what an attacker can do after compromising one credential.

The freight-security principle behind BEC prevention

Email should communicate a decision, not be the only thing that authorizes the decision. High-risk changes should be confirmed through an independent system, verified phone call, or shipment-security workflow.

Why email changes should create structured events

A driver change, destination change, or payment change should create a structured record in the TMS or security platform rather than remain only in an email thread. That record can show who requested the change, how it was verified, who approved it, and when the shipment instructions were updated.

This gives the company a second source of truth if the email account is later found to be compromised.

How to train employees without overwhelming them

Focus on a small number of repeatable behaviors: do not click unexpected login links, verify account or payment changes by phone, report unexpected MFA prompts, and treat driver or destination changes as high-risk events. Employees do not need to become cybersecurity experts to stop common BEC paths.

What should trigger an immediate security review?

• Unexpected external forwarding rules
• Login alerts from unfamiliar locations
• Multiple failed MFA requests
• Carrier complaints about loads they never booked
• Customers receiving emails employees did not send
• Unexpected driver or destination changes
• Bank changes followed by urgent payment requests

How to practice the response

Run a tabletop exercise where a broker mailbox is compromised during an active high-value shipment. Ask who secures the email account, who reviews the TMS, who contacts the carrier, who places loads on hold, who contacts the bank, and who files the IC3 report. The exercise should produce a written checklist.

The most important cultural change

Employees should not be punished for slowing down a load when a high-risk change cannot be verified. If the culture rewards speed at any cost, attackers can exploit urgency. Security needs permission to say “hold” when the facts do not match.

A freight-company BEC prevention checklist

• Enable MFA on email, TMS, load boards, and banking.
• Use unique passwords.
• Review mailbox forwarding rules.
• Verify financial changes through known contacts.
• Require a second channel for driver and destination changes.
• Remove former employees immediately.
• Train users on look-alike domains and malicious links.
• Preserve original messages after an incident.

BEC prevention works best when cyber controls and shipment controls reinforce each other. Even if one mailbox is compromised, the attacker should still have to defeat independent driver, equipment, destination, and payment verification.

Make email compromise part of cargo-theft training, not just IT training. Dispatchers, carrier sales, accounting, and warehouse contacts all need to know which changes require independent verification.

Companies should also monitor newly created forwarding rules, external forwarding destinations, impossible-travel logins, and unusual password resets. These technical signals can provide early warning before a compromised account is used to redirect a load or payment.

When one indicator appears, review recent shipment and payment changes tied to that user.

Document the review and corrective action.

Then update training so the same attack path cannot be reused.

Primary sources: FBI IC3 Cyber-Enabled Strategic Cargo Theft Alert; FBI Business Email Compromise; FBI Spoofing and Phishing.