What Is Strategic Cargo Theft, and How Do Fictitious Pickups Work?

Last reviewed: October 2026. This article is educational information, not legal or law-enforcement advice.

How is strategic cargo theft different from straight theft?

Straight cargo theft usually involves physically stealing freight from a truck, trailer, rail yard, warehouse, parking lot, or other location. Strategic theft attacks the authorization process. The criminal convinces someone that the pickup, carrier, destination, or instruction is legitimate.

That difference matters because strategic theft can succeed even at a secure warehouse. If employees believe the thief is the approved carrier, gates, cameras, and locks may not stop the shipment from leaving.

What is a fictitious pickup?

A fictitious pickup occurs when a person or truck obtains freight by pretending to be the authorized party. The thief may use a real carrier’s name, copied USDOT or MC information, altered documents, a legitimate pickup number, or information stolen from a compromised email or TMS account.

The key feature is that the shipper releases the freight voluntarily because the pickup looks legitimate.

How do criminals get enough information to look legitimate?

Information can come from phishing, compromised email, stolen load-board credentials, breached TMS accounts, social engineering, fake carrier packets, public registration data, or insiders. The FBI’s April 2026 warning described criminals gaining access to broker and carrier systems through spoofed emails, fake URLs, and malicious downloads.

Once inside, criminals can see load details, contact names, pickup numbers, commodity values, customer locations, and communication styles. That information lets them create instructions that look normal.

How does a fictitious pickup usually unfold?

• The criminal identifies a desirable shipment.
• A legitimate broker or carrier identity is copied or compromised.
• The thief obtains the pickup number or shipment details.
• A driver or truck is sent to the shipper.
• The driver presents convincing paperwork or information.
• The shipper sees no obvious mismatch and releases the freight.
• The load is redirected, cross-docked, or transloaded.
• The freight disappears into resale channels.

Can the driver be unwitting?

Yes. The FBI notes that criminals can double-broker loads to partially unwitting drivers. A legitimate driver may believe the dispatcher or intermediary is authorized and may follow false pickup or delivery instructions without knowing the freight is being stolen.

This is why a mismatch should be investigated before assuming the driver is part of the crime.

How do account takeovers fit into strategic theft?

An account takeover gives the criminal access to a legitimate company’s identity and workflow. The attacker may enter a carrier’s load-board account, broker email, dispatch mailbox, or TMS. Messages sent from the real account can look much more convincing than ordinary spoofing.

The FBI has warned that attackers may even change a legitimate carrier’s contact information or insurance information to make the stolen identity fit the targeted load.

What role does double brokering play?

Double brokering can be used as part of a strategic theft chain. A criminal posing as a carrier accepts a real load, then re-tenders it to another driver. The driver may believe the criminal is a legitimate broker or dispatcher. After pickup, the criminal changes the destination and sends the driver to a cross-dock or warehouse controlled by the theft group.

What happens after the load is picked up?

Stolen freight may be delivered to a cross-dock, transload facility, warehouse, or another truck. That breaks the visible chain between the original pickup and the people who eventually possess the goods. High-value commodities can then be resold through domestic or international channels.

Why are high-value shipments attractive?

Criminal groups increasingly select loads based on value and resale opportunity. CargoNet’s Q2 2026 analysis showed large losses involving metals and high-end technology. Enterprise hardware, networking equipment, copper, specialized metals, and other valuable freight can generate very large returns from one successful pickup.

What are common fictitious-pickup red flags?

• The driver or truck does not match the broker’s approved record.
• The carrier’s known phone number does not recognize the driver.
• The pickup is moved to a different time without normal approval.
• The driver is told to use a different carrier name.
• The equipment arrives with temporary or inconsistent identifiers.
• A last-minute email changes the pickup or destination.
• The email domain is slightly different from the legitimate company’s domain.
• A new dispatcher appears just before pickup.
• The carrier packet contains copied or inconsistent information.
• A pickup number is correct, but other identity details do not match.

Why a pickup number alone is not enough

A pickup number is useful, but it can be stolen. If a criminal has compromised email or TMS access, the number may be one of the easiest pieces of information to obtain. High-risk freight should require more than one factor of verification.

What does the FBI recommend at pickup?

The FBI recommends positive driver identity confirmation at pickup, including driver information, truck and trailer identifiers, and a secure pickup number. It also recommends increased caution when using online load boards and careful verification of the companies involved.

What should a shipper verify before releasing freight?

• Carrier legal name
• Driver name
• Tractor identifier and plate
• Trailer identifier and plate
• Pickup number
• Approved broker or carrier contact
• Any authorized substitution
• Destination information

The dock employee does not need to conduct a criminal investigation. The employee needs a simple mismatch-and-escalation process.

How should a substitution be handled?

Driver and equipment substitutions happen for legitimate reasons. The correct response is to verify the change through a known broker or carrier contact and update the approved shipment record before release.

A substitution should never be approved solely because the person requesting it knows the pickup number.

How geofenced photo verification helps

CargoGuard’s geofenced photo verification can help preserve truck and equipment photos tied to the pickup location. The record can be compared with the carrier and driver information approved for the load.

Photos do not prove legality by themselves, but they create evidence of what equipment actually appeared at the dock.

How driver verification helps

CargoGuard’s driver verification workflow can help connect the person at pickup with the load record. This is especially useful when a legitimate carrier identity may have been stolen.

How should brokers protect load-board accounts?

• Use multi-factor authentication.
• Do not reuse passwords.
• Remove former employees quickly.
• Review active sessions and authorized users.
• Train staff not to download suspicious carrier packets or “review” links.
• Verify unexpected login alerts.
• Limit administrative privileges.

What email warning signs matter?

The FBI warns about small domain changes, free email providers used to imitate real companies, shortened or spoofed links, fake negative-review messages, and unauthorized mailbox rules that forward or hide emails.

Scenario 1: copied carrier identity

A criminal uses the name and USDOT information of a real carrier. The broker verifies the federal record and assumes everything is fine. At pickup, the driver and equipment do not belong to the real carrier. A call to the carrier’s known number would expose the impersonation.

Scenario 2: compromised broker email

A broker email account is compromised. The attacker watches a high-value load and sends the shipper a message changing the driver and pickup time. Because the email comes from the real account, the instruction looks legitimate. A secondary verification requirement can stop the change.

Scenario 3: legitimate driver, fraudulent destination

A legitimate carrier and driver pick up the load correctly. Later, a compromised dispatcher account sends a new destination. The driver delivers to a fraudulent warehouse. Destination changes should therefore require verification just like pickup substitutions.

Scenario 4: cross-dock transfer

The initial driver is partially unwitting and follows instructions to a cross-dock. The freight is transferred to a different truck controlled by the thieves. Tracking and rapid escalation of an unexpected stop can reduce the time available for the criminals to complete the transfer.

What should a high-value pickup process look like?

• Pre-approve the carrier.
• Verify the dispatcher through a known contact.
• Verify driver identity before arrival.
• Send driver and equipment information to the shipper.
• Require a secure pickup number.
• Compare truck and trailer information at the dock.
• Require approval for substitutions.
• Capture pickup photos.
• Start tracking immediately after release.
• Verify any destination change through a second channel.

What should happen when a mismatch is found?

Hold the freight and verify. Use a known broker or carrier phone number, not the contact information provided in the suspicious message. Document the mismatch and who approved any resolution.

How should a theft be reported?

The FBI recommends filing a local police report and contacting the FBI or IC3 for cyber-enabled cargo theft. Preserve the shipment record, original emails, device logs, driver information, equipment details, and tracking history.

Frequently asked questions

What is strategic cargo theft?

It is cargo theft that uses fraud or deception to trick legitimate parties into handing freight to criminals.

What is a fictitious pickup?

It is a fraudulent pickup where the shipper releases freight to someone who appears authorized but is not.

Can a legitimate driver be involved unknowingly?

Yes. The FBI notes that partially unwitting drivers can be used in cyber-enabled theft schemes.

Is a correct pickup number enough?

No. Pickup numbers can be stolen. High-risk loads should use multiple identity checks.

What readers should remember

Strategic cargo theft succeeds by making a fraudulent transaction look routine. Fictitious pickups exploit trust, stolen identities, compromised accounts, and real shipment information. The strongest control is layered verification: company, dispatcher, driver, equipment, pickup number, and destination changes should all be independently confirmable.

Bottom line

Fictitious pickups are difficult because the freight often leaves through normal procedures. The most effective defense is to make normal procedures harder to impersonate. Positive driver identity, equipment matching, known-contact verification, secure pickup numbers, tracking, and cyber hygiene work together to close the gaps strategic thieves exploit.

Why fictitious pickup prevention must start before the truck arrives

Once an unauthorized truck is sitting at the dock with the correct pickup number and paperwork, employees are under pressure to keep the warehouse moving. The safest verification therefore happens before arrival. The broker should send the shipper an approved pickup profile containing the carrier, driver, tractor, trailer, and pickup reference.

The warehouse then compares the arriving truck with a known record instead of making a fresh decision based on whatever the driver presents.

Why call-back verification works

A criminal can spoof email, copy a logo, steal a pickup number, and even use the name of a real employee. It is harder to control an independently sourced phone number at the legitimate carrier or broker. A call-back requirement for material changes adds a second channel the attacker must defeat.

Call-backs are especially useful for driver substitutions, destination changes, payment changes, and after-hours pickup changes.

What a secure pickup profile should contain

• Broker load number
• Carrier legal name
• Driver name
• Tractor identifier
• Trailer identifier
• Plate information where appropriate
• Pickup number
• Approved arrival window
• Escalation contact
• Substitution status

Why carrier packets alone are weak security

A carrier packet can prove that documents exist, but a criminal can copy or alter a packet. Insurance certificates, authority numbers, logos, W-9s, and contact sheets can all be reused outside the legitimate company’s control. The packet should be one source of information, not the only proof that the person communicating about a load is authorized.

How to handle a last-minute truck change

Do not reject it automatically. Call the known carrier contact, confirm the reason, update the tractor or trailer details, and send the approved change to the shipper. The critical control is documented authorization before release.

How to handle a driver who knows all the right details

Knowing the customer, load number, commodity, and pickup number does not prove legitimacy. A compromised account can expose all of those details. Compare the driver with the pre-approved identity and equipment record and call the carrier if anything differs.

What if the actual carrier name is different at pickup?

Pause the load. Determine whether the change is an approved subcontracting arrangement, authorized co-brokering, a legitimate carrier substitution, or unauthorized re-brokering. Do not release the freight until the broker confirms who should be taking possession.

Why cross-dock instructions deserve scrutiny

Cross-docking and transloading are legitimate logistics practices, but the FBI has described criminals using them to move stolen freight out of the original transportation chain. Unexpected cross-dock instructions should therefore be confirmed through known contacts, especially for high-value shipments.

How to secure after-hours pickups

Criminals benefit when the employee who normally approves substitutions is unavailable. High-risk facilities should have an after-hours verification path and clear authority to hold freight when no one can confirm a mismatch.

How warehouse staff should be trained

• Do not release freight based on confidence or urgency.
• Compare the truck to the approved profile.
• Escalate every unexplained mismatch.
• Do not accept destination changes from the driver.
• Do not disclose pickup numbers to unknown callers.
• Preserve gate and camera records.

How brokers should review failed pickup attempts

A failed fraudulent pickup is valuable intelligence. Record the phone numbers, email addresses, driver information, truck photos, plate numbers, documents, and time of attempted pickup. Share relevant information with security partners and law enforcement when appropriate.

How to test your fictitious-pickup controls

Run a tabletop exercise. Ask what would happen if a driver arrived with the right pickup number but a different tractor, if a broker email changed the driver at 4:45 p.m., or if the carrier’s known phone number said it had no driver at the facility. The exercise should reveal who has authority to hold or release the load.

The most important control

The strongest single idea is simple: do not let one piece of information authorize a high-value pickup. Use multiple independent factors—company, driver, equipment, pickup number, and known-contact verification—so one stolen credential does not unlock the freight.

How to verify a driver without creating unnecessary delay

The best pickup process starts before the truck arrives. Ask the carrier to provide the driver and equipment details early, verify them once, and send a concise approved record to the shipper. At the gate, the employee only needs to compare what arrived with the approved record and escalate differences.

This is faster than asking the driver to restart the entire verification process at the dock and reduces pressure on warehouse staff.

How to protect pickup numbers

Pickup numbers should be treated as sensitive operational information. Do not post them in broad email groups, public notes, or unsecured shared documents. Give them only to the people and systems that need them, and avoid using the pickup number as the sole release credential on high-value freight.

How to use camera and gate records

Warehouse cameras and gate logs can provide critical evidence after a theft. Make sure camera timestamps are accurate, retention is long enough for delayed discovery, and gate records include enough detail to connect the truck with a specific shipment.

Why destination verification belongs in the same process

A perfectly verified pickup can still become a strategic theft if a compromised account redirects the load after departure. High-value security programs should treat destination changes with the same seriousness as driver substitutions and require independent confirmation before the driver acts.

How brokers and shippers should share responsibility

The broker usually has the carrier relationship and the shipper controls physical release. The strongest process connects those two roles. The broker sends the approved driver and equipment record; the shipper compares it with the arrival; both parties know who owns exceptions.

A fictitious-pickup response checklist

• Stop the release immediately.
• Move the load to a secure hold status.
• Call the broker using a known number.
• Call the carrier using an authoritative number.
• Compare driver and equipment information.
• Preserve gate, camera, and document records.
• Record plate numbers and vehicle descriptions.
• Do not disclose additional pickup information to the suspicious party.
• Notify security and law enforcement when appropriate.

After the incident, review how the person obtained the pickup information. If the pickup number, driver name, or load details came from compromised email or TMS access, other shipments may also be exposed.

How to reduce false positives

Legitimate carriers change drivers and tractors. A strong system should make it easy to verify and approve those changes instead of treating every substitution as theft. The goal is not to block normal operations; it is to make unauthorized substitutions difficult to hide.

What management should audit each month

• Loads released with unresolved driver mismatches
• Unapproved substitutions
• Failed or suspicious pickup attempts
• High-value loads without equipment verification
• After-hours exceptions
• Destination changes after pickup

Reviewing these events helps the company see whether its controls work consistently across offices and shifts. The purpose is not to create more paperwork; it is to identify where criminals could make a fraudulent pickup look normal.

For high-value shippers, consider requiring the broker to send the approved driver and equipment profile before the truck reaches the gate. This gives warehouse staff time to review the information without the pressure of a waiting driver.

Keep the escalation contact visible at the dock so employees know exactly who can approve a last-minute change.

Finally, do not let a secure pickup number become a shared password used across multiple loads or customers. Use shipment-specific values, limit who can see them, and change the process if pickup numbers regularly circulate through broad email groups. A secure number works best as one factor in a larger verification process, not as the only proof that the person at the dock is authorized.

Review failed attempts with the same seriousness as completed thefts because they reveal how criminals are testing the company’s process and what information they already possess.

Primary sources: FBI Cargo Theft; FBI IC3 Cyber-Enabled Strategic Cargo Theft Alert.