FMCSA Motus Identity Verification: 7 Key Requirements

Last reviewed: October 2026. This article describes FMCSA’s current Motus process for carriers, brokers, freight forwarders, and other regulated entities. Procedures may continue to evolve as FMCSA updates Motus.

Why did FMCSA add identity verification?

FMCSA has described Motus as part of a broader anti-fraud modernization effort. The agency says identity verification is designed to protect registration data, prevent unauthorized access, and make it harder for bad actors to create or take over fraudulent transportation identities.

Fraudulent carrier and broker registrations have become a major industry concern because stolen or fabricated federal identities can be used to obtain freight, redirect payments, impersonate legitimate companies, or create new authorities for fraud schemes.

Who has to create a Motus user profile?

FMCSA says any individual who needs to use Motus for protected registration functions must create a user profile. A user can have one profile and, where authorized, access multiple company accounts.

This applies to people acting for motor carriers, brokers, freight forwarders, intermodal equipment providers, cargo tank facilities, supporting companies, and other entities that use FMCSA registration services.

Does Motus use Login.gov?

Yes. Motus uses Login.gov credentials for access. Users can sign in with an existing Login.gov account or create a new one. FMCSA also uses multi-factor authentication as part of the login process.

For existing registrants, FMCSA advised company officials to use the same Login.gov email associated with their legacy FMCSA Portal account when linking the company to Motus.

What documents do users need for identity verification?

FMCSA’s Motus quick-start guide tells users to have a valid government-issued identity document available. Examples listed by FMCSA include a government identity card, driver’s license, passport, or resident card.

The exact acceptable-document list can depend on the identity-verification service and the user’s circumstances, so users should follow the current on-screen instructions.

Does FMCSA require a selfie?

FMCSA’s May 2026 quick-start guide states that the identity-verification process prompts users to capture images of their face and government ID. Login.gov describes selfie verification as a process used by some partner agencies to compare the person’s face with the identity document.

That means the current Motus process can include a face image matched with the government-issued ID as part of verifying the individual user.

Do users need a smartphone?

Users need access to a device with a camera for the remote verification process. FMCSA’s guide says a smartphone, tablet, or computer with a webcam can be used. On a desktop computer, the system may display a QR code so the user can continue the camera portion on a mobile device.

What if someone does not have a camera?

FMCSA says users who cannot complete remote identity verification may be directed to a designated physical location or enrollment center to complete the process in person. The FMCSA Contact Center can help users who are unable to complete verification.

Is identity verification the same as business verification?

No. Motus separates the identity of the individual user from the identity of the company. First, the person creates a user profile and verifies personal identity. Then the regulated entity creates or claims a company account and completes the business-verification steps required by FMCSA.

This distinction helps prevent an identity-verified person from automatically gaining access to any transportation company. The user also must have an authorized relationship with the company account.

What is a main account holder?

Motus uses account roles to control company access. A main account holder can manage company information and invite additional authorized users. Sub-account holders can be invited to perform permitted functions without necessarily having the same user-management privileges.

FMCSA’s guidance says sub-account users should wait for an invitation from the company’s main account holder before setting up access to that company account.

What happened to the USDOT PIN?

FMCSA says a USDOT PIN is not required to create a company account or register in Motus. The modern process relies on verified user identities, Login.gov credentials, company-account roles, and business verification rather than the old PIN-centric access model.

How does Motus reduce account takeover risk?

The system combines individual identity verification with company-level permission controls. A user cannot simply know a USDOT Number and automatically gain administrative control of the company record. The user must establish a verified identity and be linked to the company through Motus’s account process.

FMCSA also requires supporting companies to be designated by the regulated entity before they receive access to that company’s account.

What are supporting companies?

Supporting companies can include transportation service providers, BOC-3 blanket companies, insurance or surety organizations, and other service providers that perform filings or related work for regulated entities.

FMCSA says supporting companies also must create user profiles and company accounts and complete identity verification. A registrant must designate the supporting company, and the provider must accept the designation before it receives authorized access.

Does Motus verify business addresses?

FMCSA’s modernization materials say Motus uses business validation and address checks as part of its anti-fraud design. The agency may reject registration information that fails statutory or regulatory requirements or that cannot be validated appropriately.

This matters because fraudulent registrations have historically used false addresses, virtual locations, copied company information, or other data that makes the entity difficult to verify.

Does identity verification prove a carrier is safe?

No. Motus identity verification confirms the individual user behind an account and supports the integrity of company registration. It does not certify that the company will operate safely, that every driver is qualified, or that every shipment is legitimate.

Brokers should continue reviewing authority, insurance, relevant safety information, carrier identity, shipment-level driver information, and other risk factors appropriate to their process.

Does identity verification eliminate carrier identity theft?

No security control eliminates all fraud. Motus makes it harder to create or take over registration records anonymously, but fraud can still occur through phishing, stolen credentials, fake emails, compromised company accounts, or impersonation outside FMCSA systems.

Shipment-level verification therefore remains important even when the carrier’s FMCSA account is legitimate.

How should brokers use Motus information?

Brokers should treat Motus as the authoritative registration environment for current FMCSA entity and filing information, while still independently verifying the people communicating about a specific load. A real USDOT Number does not prove that the email or phone contact belongs to that company.

Use known contact information and shipment-level verification to connect the registered business to the dispatcher, driver, and equipment handling the freight.

How does this compare with CargoGuard driver verification?

FMCSA’s Motus identity verification protects access to a federal company-registration account. CargoGuard’s driver verification workflow addresses a different problem: whether the person and equipment arriving for a specific shipment match the approved load information.

Both use identity concepts, but the subjects and purposes are different. Motus verifies the user administering the company’s FMCSA registration. CargoGuard can help verify the shipment-level driver and equipment.

What should a new broker prepare before using Motus?

• A Login.gov account
• A valid government-issued identity document
• A device with a camera or access to an in-person verification option
• Accurate legal business information
• Business address and contact information
• Information required for broker registration
• Financial-responsibility and BOC-3 filings as applicable

What should an existing carrier or broker do?

Existing registrants should make sure the correct company official controls the Motus account, invite only authorized users, remove access when employees or service providers leave, and keep company information current.

Account-access reviews should become part of normal security procedures, just like bank, TMS, email, and factoring account reviews.

Scenario 1: a company official cannot pass remote verification

The user should follow the troubleshooting instructions and contact FMCSA if verification cannot be completed. FMCSA says the user may be referred to a physical location to complete identity verification.

Scenario 2: former employee still has company access

The main account holder should remove the person’s access immediately. Company-account permissions should be reviewed regularly so former employees or vendors do not retain registration authority.

Scenario 3: broker receives an email claiming FMCSA needs a selfie

Do not upload identity documents through an unsolicited email link. Navigate directly to official FMCSA or Login.gov services and confirm the request there. Fraudsters can imitate government notices to steal identity documents.

Scenario 4: service provider wants access to the company account

Use Motus’s official designation and invitation process. Do not share a main account holder’s credentials with a third-party registration service.

Frequently asked questions

Does FMCSA require a photo of your ID?

FMCSA’s Motus quick-start guide says users follow prompts to capture images of a government-issued ID as part of identity verification.

Does FMCSA require a face photo?

The Motus guide states that users capture images of their face and government ID during identity verification.

Can one verified user manage multiple companies?

FMCSA says one user profile can access multiple company accounts when the user is properly authorized.

Do brokers still need a USDOT PIN?

FMCSA says a USDOT PIN is not required to create a company account or register in Motus.

What readers should remember

Motus now ties FMCSA registration access to verified individual users rather than relying primarily on legacy credentials and USDOT PINs. Users sign in through Login.gov and complete an identity check that can include images of their government ID and face. Regulated companies also complete company verification and control access through account roles. These steps strengthen federal registration security but do not replace carrier vetting or shipment-level identity verification.

Bottom line

FMCSA’s 2026 Motus rollout makes identity verification a core part of registration security. Carriers and brokers should treat their Motus account like a high-value financial or operational account: verify the right people, limit access, remove old users, and never share credentials. Brokers should then connect that trusted registration identity with separate shipment-level verification to reduce impersonation and cargo fraud.

Why identity verification matters to brokers specifically

Broker identities are valuable because a fraudulent broker record can be used to post loads, obtain carrier capacity, redirect payments, and create convincing communications. Requiring a verified individual behind the federal registration increases accountability and makes anonymous account creation more difficult.

The same logic applies to motor carriers. A fraudulent carrier registration can be used to obtain freight under a false identity. Motus does not eliminate that risk, but verified account access creates a stronger starting point than a system based largely on static credentials.

What is business verification?

Business verification is the company-level process that connects a verified individual user to a regulated entity. FMCSA reviews company information and uses validation controls to determine whether the entity and its registration details satisfy federal requirements.

This helps separate “I am a real person” from “I am authorized to control this company’s federal registration.” Both questions matter.

How should companies choose the main account holder?

The main account holder should be a trusted person with ongoing responsibility for the company’s registration. Avoid using a temporary consultant, former employee, or outside vendor as the only person with administrative control. At least one internal leader should understand how access is managed and how to recover the account.

Should companies share Login.gov credentials?

No. Each person should use their own identity-verified account and receive the appropriate Motus role. Shared credentials defeat the purpose of individual accountability and create security problems when employees leave.

How often should Motus access be reviewed?

Review company access at least periodically and whenever an employee or service provider changes roles or leaves. Remove stale users promptly. A quarterly access review is a practical starting point for many organizations.

What should a broker do after a suspected account takeover?

• Contact FMCSA through official channels.
• Review Motus users and roles.
• Secure the associated Login.gov account.
• Reset compromised email credentials.
• Review recent registration changes.
• Notify insurers and counsel if fraud occurred.
• Warn customers and carriers if someone impersonated the company.
• Preserve evidence of fraudulent communications.

How phishing can bypass strong identity controls

Identity verification is strongest at account creation, but criminals can still target users later with phishing emails, fake Login.gov pages, or social engineering. Employees should navigate directly to official government websites rather than clicking unexpected identity-verification links.

Companies should train registration staff to recognize fake Motus or FMCSA notices, especially messages that request passwords, one-time codes, or identity documents by email.

What data should a company keep outside Motus?

Motus is the federal registration system, not a replacement for internal security records. Companies should separately maintain authorized-user lists, vendor-access approvals, security contacts, change logs, and incident records according to their own policies.

How Motus changes registration-service relationships

Third-party registration services should no longer need a company’s shared login credentials. FMCSA’s designation process lets the regulated entity authorize a supporting company through the system. This creates clearer accountability and makes it easier to revoke access later.

What if a consultant created the old FMCSA Portal account?

The company should make sure an internal authorized official can control the Motus account. FMCSA’s transition guidance emphasized using the correct company-official email when linking existing records. If ownership or access is unclear, contact FMCSA rather than sharing credentials informally.

How identity verification affects new-company setup

New carriers and brokers should plan for identity verification as a normal part of startup registration. A founder or company official should have government-issued ID, camera access, accurate business information, and time to resolve validation issues before expecting the registration process to be complete.

A Motus security checklist

• Use an individual Login.gov account.
• Complete identity verification only through official channels.
• Keep multi-factor authentication secure.
• Choose a trusted main account holder.
• Invite users rather than sharing credentials.
• Review users quarterly.
• Remove former employees immediately.
• Use official supporting-company designations.
• Monitor company registration information for unauthorized changes.
• Train staff on phishing.

How does Motus identity verification fit into a larger fraud stack?

Think of Motus as protecting the federal registration layer. Email security protects communications. TMS access controls protect operational data. Payment verification protects bank changes. Driver and equipment verification protect physical pickup. No single layer replaces the others.

CargoGuard fits at the shipment layer by helping brokers verify the driver, equipment, photos, and tracking events associated with an individual load. That complements, rather than duplicates, FMCSA’s account-level identity controls.

What should companies do with identity-verification failures?

A failed verification attempt does not automatically mean fraud. Image quality, document damage, name differences, technical problems, or accessibility issues can interfere with automated verification. Users should follow the official troubleshooting path and contact FMCSA rather than creating a second identity or using another employee’s credentials.

Why role-based access matters

Not everyone who works for a carrier or brokerage needs full control of the federal registration account. Use the minimum level of access needed for each employee. Limiting administrative privileges reduces the damage that can occur if an account is compromised.

How to document Motus account ownership internally

• Name the primary company official.
• Name at least one backup administrator where permitted.
• Record authorized supporting companies.
• Keep a current list of sub-account users.
• Document the process for removing access.
• Store FMCSA support contact information with the security plan.

What should happen when a registration service is terminated?

Revoke the supporting company’s Motus access, confirm that internal users still control the account, review recent filings, and change any related credentials outside Motus that the provider may have used. Do not leave old vendors connected simply because the relationship ended quietly.

Why Motus does not replace load-level verification

A verified Motus account tells you more about who controls the federal registration record. It does not prove that the person emailing a rate confirmation today is that account holder or an authorized employee. Brokers still need call-back verification, secure email practices, payment-change controls, and driver/equipment checks for suspicious or high-risk loads.

Fraud prevention works best when identity is verified at multiple layers: federal registration, company communications, payment instructions, and physical pickup.

A practical onboarding workflow for a new Motus user

• Create or sign into an individual Login.gov account.
• Complete multi-factor authentication.
• Accept the FMCSA system rules of behavior.
• Complete identity verification using the official process.
• Create or claim the appropriate company account.
• Complete required business verification.
• Invite additional users through Motus rather than sharing credentials.
• Assign only the roles each user needs.

Companies should document this process in their internal registration procedures so access does not depend on one employee remembering how the account was originally created.

The larger lesson for freight fraud prevention

FMCSA’s move toward verified identities shows how important it has become to connect digital actions with accountable people. The same principle can be applied throughout a freight workflow: verify the company behind the authority, the person behind the company account, the dispatcher behind the load communication, the driver behind the pickup, and the equipment behind the physical handoff.

No single verification step is enough by itself. Layered identity controls make impersonation harder and give investigators a stronger record when something goes wrong.

For companies with multiple offices, the safest approach is to centralize ownership of the Motus account while giving local staff only the access they actually need. That prevents separate offices from creating competing credentials or relying on one outside registration service to control the federal record.

Security teams should include Motus access in employee offboarding. When a user leaves the company, remove their Motus role at the same time email, TMS, banking, and other operational access is revoked.

A final security point: identity verification is only as strong as the recovery process around the account. Keep corporate email ownership current, protect multi-factor authentication methods, and make sure a trusted internal administrator can recover access if the primary user becomes unavailable.

Primary sources: FMCSA Move Into Motus; FMCSA Motus Quick-Start Guide; FMCSA Registration Modernization FAQs.