Is Cargo Theft Getting Worse in 2026?

Cargo theft 2026 data shows why incident count alone can be misleading: fewer reported thefts can still produce much larger total losses when organized groups target higher-value freight.

Cargo Theft 2026: What the Loss Data Shows

Last reviewed: October 2026. Cargo-theft statistics are based on reported incidents and can change as additional cases are reported.

Are cargo theft incidents actually increasing in 2026?

Not in the simple sense. CargoNet’s Q2 2026 analysis documented 677 incidents, which was 14% lower than Q1 2026 and 26% lower than Q2 2025. Physical thefts of loaded equipment and some forms of non-delivery fraud declined, especially in major theft markets such as California and Texas.

But incident count alone gives an incomplete picture. The value of stolen cargo increased sharply, which means fewer incidents are producing much larger financial losses.

How much was lost in Q2 2026?

CargoNet estimated Q2 2026 losses at $304.6 million. That was more than double the $135.7 million estimated for Q2 2025. Among incidents where a commodity value was reported, the average loss reached approximately $564,009, although CargoNet noted that a small number of multimillion-dollar thefts pushed that average higher.

The trend shows why loss severity matters. A single stolen trailer of enterprise networking equipment, cryptocurrency-mining hardware, specialized metals, or other high-value cargo can create a loss equal to dozens of ordinary thefts.

Why are losses rising when incidents are falling?

Organized theft groups are becoming more selective. CargoNet said the groups producing the largest losses appear to be focusing less on stealing the greatest number of loads and more on identifying the right shipment. They are targeting commodities with high value, strong resale demand, and supply-chain characteristics that allow the goods to move quickly after theft.

This shift rewards intelligence. Criminal groups that gain access to broker, carrier, or shipper systems can identify valuable loads before they ever reach a parking lot or warehouse. That creates a very different threat from opportunistic trailer theft.

Which commodities are being targeted?

Metals and enterprise technology were major 2026 targets. CargoNet reported that metal theft incidents increased from 54 in Q2 2025 to 80 in Q2 2026. Copper remained the most frequently targeted metal, while aluminum, nickel, tungsten, and other specialized industrial metals also appeared in theft activity.

Organized groups also targeted enterprise-grade computer equipment, networking hardware, components, and cryptocurrency-mining hardware. Some of these loads can be worth several million dollars while still moving as ordinary dry freight, making them attractive when the transportation process does not reflect their true value.

What happened to food and beverage theft?

CargoNet reported that food and beverage theft declined overall in Q2 2026, although not every category moved in the same direction. Beverage and mixed-grocery thefts fell, while seafood theft increased. Auto parts, tires, supplements, protein products, and over-the-counter medications also saw declines.

The larger lesson is that commodity risk changes. A security plan built around last year’s hottest category can miss the next shift.

What is strategic cargo theft?

The FBI defines strategic cargo theft as theft that uses deception to trick shippers, brokers, or carriers into handing freight to criminals. Current methods include identity theft, fictitious pickups, account takeovers, double-brokering scams, fraudulent carriers, and combinations of these techniques.

Unlike straight theft, strategic theft may begin days before pickup with a phishing email, fake carrier identity, compromised load-board account, or altered dispatch instruction. By the time the truck arrives, the shipper may believe it is releasing the load to a legitimate carrier.

What is cyber cargo theft?

The FBI uses the term cyber cargo theft for theft enabled by cyberattacks. Criminals may use phishing, malware, stolen credentials, or remote monitoring software to access broker or carrier systems. Once inside, they can view load information, impersonate employees, alter shipment details, or create convincing paperwork for a fictitious pickup.

This is one reason cargo security and cybersecurity can no longer be treated as separate departments.

What did the FBI warn about in 2026?

In April 2026, the FBI’s Internet Crime Complaint Center issued a public warning about cyber-enabled strategic cargo theft. The FBI said threat actors increasingly compromise broker and carrier systems through spoofed emails, fake URLs, and malicious downloads. Criminals then use compromised accounts to post fraudulent loads, bid on real freight, manipulate bills of lading, redirect shipments, and move stolen cargo through cross-docks or transload facilities.

The FBI said estimated cargo theft losses in the United States and Canada reached nearly $725 million in 2025, a 60% increase from 2024, while confirmed cargo theft incidents increased 18%.

Is business email compromise still a major threat?

Yes. CargoNet said business email compromise remained a primary access point for sophisticated cargo theft schemes in Q2 2026. Compromised accounts can expose shipment information, contacts, transportation management systems, and internal communication patterns.

Once criminals understand how the business communicates, a fake change to a driver, destination, payment instruction, or pickup time can look routine.

What happened to fictitious pickups?

CargoNet recorded 158 fictitious pickup incidents in Q2 2026 compared with 165 in Q2 2025. That is only a small decline compared with the larger drop in overall theft incidents. The persistence of fictitious pickups supports the broader picture: deceptive, compromise-based theft remains active even when physical theft volume falls.

What is a fictitious pickup?

A fictitious pickup occurs when a criminal obtains freight by convincing the shipper or warehouse that the person or truck is authorized to receive it. The criminal may use stolen carrier information, fake documents, compromised email, a legitimate pickup number, or a driver who does not realize the load has been diverted.

The freight can leave through the front gate without a lock being cut or a trailer being broken into.

Why traditional cargo security can miss strategic theft

Locks, fences, cameras, and guarded yards remain important, but strategic theft attacks authorization rather than physical barriers. If the warehouse believes the thief is the approved carrier, strong physical security may actually help the criminal because employees confidently release the load through normal procedures.

What should brokers verify before tendering a high-value load?

• Carrier legal identity and current authority
• Known contact information from an independent source
• Whether the dispatcher is actually associated with the carrier
• Driver name and assignment
• Tractor and trailer identifiers
• Any recent contact or payment changes
• Whether substitutions require approval
• Whether the carrier’s equipment and operation fit the load

What should shippers verify at pickup?

The FBI recommends that shippers work closely with transportation partners to confirm positive driver identity at pickup, including driver information, truck and trailer identifiers, and a secure pickup number. This is especially important for theft-sensitive freight.

• Compare the driver with the approved shipment record.
• Compare tractor and trailer information.
• Verify the pickup number.
• Confirm any last-minute substitution through the broker.
• Do not rely only on paperwork presented by the driver.
• Escalate any unexplained mismatch before release.

How driver and equipment verification help

CargoGuard’s driver verification workflow can help connect a specific driver and equipment record to the load. Geofenced photo verification can help preserve truck and pickup photos at the location where custody changes.

Those controls do not guarantee a load cannot be stolen, but they make it harder for an unauthorized driver or truck to pass through a normal pickup process without creating a mismatch.

How real-time tracking fits into cargo theft prevention

Tracking helps after pickup by showing whether the shipment follows the expected route and whether unexpected stops or diversions occur. But tracking should not be treated as a substitute for verifying who received the freight. A tracked device can still be attached to the wrong truck or left behind.

What should companies do when a shipment is diverted?

• Verify the driver and carrier using known contact information.
• Preserve GPS and communication records.
• Confirm whether the destination change was authorized.
• Notify the shipper, broker, carrier, insurer, and security team.
• Contact law enforcement when theft is suspected.
• File an IC3 complaint when the incident involves cyber-enabled fraud.

What are the highest-risk moments in a truckload move?

Risk is often highest when information changes hands: load tender, carrier selection, driver assignment, pickup, destination change, payment instruction, and delivery. Criminals exploit these transition points because one believable message can override an otherwise secure process.

Scenario 1: valuable electronics booked under a compromised carrier

A criminal gains access to a legitimate carrier’s load-board account, books a high-value technology load, and sends a different driver to pickup. The carrier’s federal identity is real, so a basic authority check passes. Shipment-level driver and equipment verification is what can expose the difference.

Scenario 2: copper load redirected after pickup

The driver is legitimate, but a compromised email account sends a new delivery address. The driver follows the instruction and delivers to a fraudulent cross-dock. A call-back policy for destination changes could stop the diversion.

Scenario 3: physical trailer theft

A loaded trailer is left unattended overnight and physically stolen. This remains a straight cargo theft problem and requires traditional physical controls such as secure parking, locks, surveillance, and route planning.

What should a 2026 cargo security program include?

• Carrier identity verification
• Driver and equipment verification
• Multi-factor authentication
• Phishing training
• Secure load-board credentials
• Destination-change verification
• Payment-change verification
• Real-time tracking
• High-value cargo escalation
• Secure parking requirements
• Incident-response procedures
• Law-enforcement reporting contacts

Frequently asked questions

Is cargo theft increasing in 2026?

Reported incident volume fell in Q2 2026 compared with Q2 2025, but estimated losses more than doubled to $304.6 million. The threat is becoming more financially severe.

What cargo is being targeted?

Metals and high-end technology were major Q2 2026 targets, although thieves continue to pursue many categories.

Are fictitious pickups still common?

Yes. CargoNet recorded 158 in Q2 2026, only slightly below the 165 recorded in Q2 2025.

Is cybercrime now part of cargo theft?

Yes. The FBI has specifically warned about phishing, compromised accounts, fake load-board activity, malicious downloads, and shipment redirection.

What readers should remember

Cargo theft in 2026 is not simply getting more frequent. It is getting more selective and more expensive. Q2 incident volume fell, but estimated losses more than doubled. Strategic and cyber-enabled schemes remain active, and business email compromise continues to expose high-value shipment information. The strongest defense combines cybersecurity with driver, equipment, pickup, tracking, and physical-security controls.

Bottom line

The 2026 cargo theft environment rewards organized criminals that can identify the right load and manipulate the right person. Companies should stop measuring risk only by the number of thefts and focus on loss severity, account compromise, fictitious pickups, high-value commodities, and shipment identity. Fewer incidents do not necessarily mean a safer supply chain.

Why cargo theft risk should be measured by severity, not just count

A declining incident count can create false confidence. A security program should track the total value at risk, average and median loss, commodity concentration, theft type, geographic exposure, and how often cyber compromise appears in the loss chain. A company with fewer thefts but one multimillion-dollar electronics loss may have a worse year financially than a company with many lower-value incidents.

This is especially important for insurers, shippers, and brokers that handle high-value freight. The security controls for a $40,000 dry-goods load should not automatically be identical to the controls for a $2 million networking-hardware shipment.

How to identify theft-sensitive commodities

Look beyond commodity description and ask how easily the freight can be resold, concealed, or moved. Specialized metals, electronics, pharmaceuticals, alcohol, branded consumer goods, food products, and other categories can become targets when resale demand rises. Commodity risk should be reviewed regularly because criminal groups adapt quickly.

• High unit value
• Strong resale market
• Easy transloading
• Limited serial-number tracking
• Ordinary dry-van appearance
• Predictable lanes or pickup schedules
• Weak pickup verification

Why enterprise technology is especially difficult to protect

Enterprise servers, networking gear, and related hardware can travel in standard packaging without obvious external indicators of value. To a casual observer, the trailer may look like ordinary dry freight. To an organized theft group with inside information or compromised systems, the load may represent millions of dollars.

That mismatch between visible appearance and actual value makes digital shipment data extremely sensitive. Access to a commodity description, customer name, origin, destination, and appointment schedule can be more valuable to a thief than physically scouting a warehouse.

Why metals remain attractive

Metals can be valuable, fungible, and relatively easy to move into secondary markets. Copper is particularly attractive because it has established resale demand. Specialized metals can carry even higher value. A broker or shipper should therefore avoid treating industrial freight as low risk simply because it does not resemble consumer electronics.

How to score a shipment before pickup

A simple risk score can help decide which loads receive enhanced controls. The score should be based on objective shipment factors rather than weak identity proxies.

• Commodity value
• Theft sensitivity
• Origin and destination region
• Weekend or overnight dwell
• New carrier relationship
• High-risk route or parking exposure
• Recent contact or banking changes
• Need for cross-docking or transloading

What high-risk loads should trigger

• Enhanced carrier verification
• Driver identity verification
• Equipment photos
• Secure pickup number
• Secondary approval for substitutions
• Continuous or frequent tracking
• No unplanned destination changes
• Approved parking or stopping policy
• After-hours security contact

Why weekend and holiday planning still matters

Straight theft remains a threat when loaded equipment sits unattended. A high-value load picked up Friday afternoon and parked until Monday creates a different risk profile from freight moving directly to destination. Route planning, secure parking, yard controls, and driver instructions should reflect dwell time.

How cybersecurity teams should work with freight operations

Cyber teams may see suspicious login activity before operations sees a freight problem. Operations may see fake driver changes before IT realizes an account is compromised. Companies should create a shared escalation channel for suspicious email, unauthorized mailbox rules, unusual TMS activity, and shipment changes.

When a high-value shipment is active, a compromised mailbox should trigger a review of every load that account touched.

How to respond to a suspected cargo theft

• Confirm the last verified driver and equipment.
• Preserve all tracking and communication records.
• Contact the legitimate carrier through a known number.
• Notify local or state law enforcement.
• Contact the FBI or IC3 when cyber-enabled theft is involved.
• Notify cargo insurers and customers.
• Preserve video, gate logs, and pickup photos.
• Do not alter original emails or documents.

What metrics should a freight-security team report monthly?

• Loads placed on security hold
• Driver or equipment mismatches
• Unauthorized destination changes
• Account-compromise incidents
• High-value loads using enhanced verification
• Unexplained tracking gaps
• Fraud attempts stopped before pickup
• Cargo theft claims and total loss value

The goal is to understand both prevention and loss. A company that catches more suspicious pickups may actually be improving its security even if the number of alerts rises.

What 2026 teaches about cargo theft

The main lesson is that cargo theft is becoming an information problem as much as a physical-security problem. Organized groups want to know what is moving, who controls it, how the parties communicate, and where the load can be redirected. The companies that protect their identity, account access, and pickup process are better positioned than companies that rely only on locks and cameras.

How brokers should segment cargo-theft controls by value

A practical security program uses tiers. Low-risk routine freight may use standard carrier and tracking controls. Medium-risk loads may add driver and equipment confirmation. High-value or theft-sensitive freight should add known-contact verification, equipment photos, substitution approval, enhanced tracking, after-hours escalation, and stricter destination-change procedures.

Risk tiers should be easy for operations teams to understand. If employees need a 40-page manual to decide what applies, they are more likely to bypass the process when freight is urgent.

Why security controls need after-hours coverage

Cargo theft groups do not operate only during normal office hours. A Friday evening pickup or Sunday destination change can expose a gap if the person who normally verifies changes is unavailable. High-risk freight should have an after-hours contact with authority to hold, approve, or escalate a load.

How to review a theft attempt that did not succeed

Near misses are valuable. If a fraudulent driver is stopped at the dock, preserve the phone number, email address, documents, truck photos, plate, time, and carrier information. Review how the attacker obtained the pickup information and whether another load could be exposed through the same compromised account or process.

What executives should take from the 2026 data

The Q2 numbers argue against measuring security success only by incident count. Leadership should ask how many high-value loads receive enhanced controls, whether cyber incidents are connected to shipment reviews, how quickly suspicious pickups are stopped, and whether the company can reconstruct custody after a loss.

A final 2026 cargo-theft checklist

• Know which commodities deserve enhanced controls.
• Verify carriers through authoritative sources.
• Confirm driver and equipment before release.
• Require secondary approval for substitutions and destination changes.
• Use MFA and secure load-board access.
• Preserve tracking and pickup evidence.
• Have an after-hours security contact.
• Review near misses as seriously as completed thefts.

The 2026 data shows that organized groups are getting more selective. A security program should therefore protect the highest-value decisions in the shipment lifecycle, not just the physical trailer.

For high-value shippers, review commodity risk quarterly and adjust controls before theft patterns shift again. Security policies should move as quickly as the threat.

Brokerages should also compare theft alerts with customer shipment value, lane, and commodity data so enhanced controls are applied before the load is tendered rather than after a loss occurs.

A short quarterly review can identify which commodities, facilities, carriers, and routes deserve stronger verification.

Document those decisions by load.

Keep the process simple, repeatable, and visible to every shift.

Primary sources: Verisk CargoNet Q2 2026 Theft Trends; FBI IC3 Cyber-Enabled Strategic Cargo Theft Alert; FBI Cargo Theft.