On July 28, Highway released its Q2 2026 Freight Fraud Index, and one number in it deserves a full stop: communication-based attacks — compromised inboxes, spoofed emails, account takeovers, and impersonation phone calls — accounted for 50% of all classified fraud vectors in the second quarter, up from 42.7% in the first. Half of freight fraud no longer starts with a stolen trailer or a fake MC number. It starts with a message that looks like it came from someone you already trust.
For a small carrier this is personal in two directions at once. Your company’s identity — your MC number, your email domain, your phone number, your clean record — is the asset being hijacked. And your inbox and your phone are the doors it gets hijacked through. The numbers first, then the fix: the Five-Lock Protocol, a hardening pass you can run on your whole operation in one afternoon, most of it free.
The Numbers: Fraud’s Front Door Is Now the Inbox
The scale in Highway’s Q2 data is hard to overstate. The platform blocked 784,201 fraudulent inbound emails in the quarter — up 48.5% from Q1 and 58.3% year over year — and intercepted 109,995 fraudulent or spoofed phone calls, a 53.2% quarterly surge and a 159.3% annual increase. Attempts to impersonate Highway itself jumped 282% quarter over quarter, with 1,740 new entries added to its impersonation watch list. And ownership-change fraud — someone quietly filing paperwork to take over a legitimate authority — accounted for 25.6% of reported thefts, up from 23.0% in Q1, even as ownership discrepancy alerts declined, meaning the fraudulent filings are getting cleaner and harder to flag.
The trend line behind those numbers has been building all year. Highway’s Q1 index logged 527,940 blocked emails, 71,801 spoofed calls, and 2,256 reported identity thefts — the last figure up 89.6% year over year — and found that roughly half of all theft incidents traced back to carriers holding legitimate MC numbers and previously clean operating histories. The stakes underneath it all: Verisk CargoNet estimates cargo theft losses hit $725 million in 2025, and every quarterly print since has pointed the same direction.
What Changed: From Fake Carriers to Hijacked Ones
Two years ago the dominant play was the fake carrier — buy or fabricate an authority and run it until it burned. We covered that underground trade in our report on the $24,000 black market for MC numbers. But the walls went up: FMCSA’s registration-system overhaul, the Montgomery broker-liability fallout that made everyone vet harder, and platforms tying carrier vetting directly to the ELD. So the criminals adapted. Highway’s conclusion is blunt: rather than creating fake identities, fraudsters are now exploiting existing trust — compromising legitimate contact methods and ownership documentation. As the report puts it, “almost every successful theft starts with a bad actor exploiting your trust.”
Here is what that looks like at five trucks. An email that appears to come from your factoring company with updated remittance details. A call from “Highway” or “your broker’s compliance team” that needs you to read back a login code. Your own dispatch inbox quietly compromised, with a forwarding rule shipping every rate confirmation to a stranger for three weeks. An ownership-change filing on your authority that you never made. Not one of those requires anyone to touch your truck — and every one of them ends with your freight, your money, or your name in someone else’s hands. The Five-Lock Protocol closes those doors in order.
Locks One and Two: Harden the Inbox, Then the Phone
Lock One is email. Today — not this month — turn on multi-factor authentication for every account the business touches: dispatch email, owner email, factoring portal, load boards, vetting platforms, bank. Use a different password for each. Then do the check almost nobody does: open your email settings and look at the forwarding rules and filters. When crooks take over an inbox, the first thing they plant is a quiet auto-forward so they can read your rate confirmations for weeks without logging in again. If you find a rule you did not create, delete it, change the password, and sign out of every active session before you do anything else. From now on, any mid-stream change to payment details or pickup instructions — from anyone — is treated as fraud until verified.
Lock Two is the callback discipline, and it is the single highest-value habit in this article. You never act on instructions that arrive inbound — and you never verify them using the number or link inside the message itself. You hang up and call back on the number you already have on file: the one on the rate confirmation, the contract, or the platform’s own website. Make it a stated company rule, drivers included, and deliver it in these exact words every time:
Watch what happens next. A legitimate caller says “no problem” — every time. A fraudster escalates the urgency: the driver is waiting, the load cancels in ten minutes, the account gets locked today. Urgency is the tell. Nothing real in this industry dies in the five minutes a callback takes.
Lock Three: Watch Your FMCSA File Like a Bank Account
Ownership-change fraud is now a quarter of reported thefts and rising — and the alerts that used to flag it are declining, which means the fake filings look increasingly like real ones. Your defense is a ten-minute monthly ritual, same as reconciling a bank statement. Pull your own carrier record on FMCSA’s system and verify five things: legal name, physical address, email on file, phone on file, and listed ownership. Confirm your registration login still works and that the email attached to it is one only you control. If anything has changed that you did not change — same day, no waiting: contact FMCSA to dispute the filing, notify every active broker and customer in writing that your authority may be compromised and that all instructions should be verified by phone, and document everything with dates. The carriers who get destroyed by identity theft are almost never the ones who caught it in week one.
Lock Four: No Inbound Caller Passes the Credential Test
The 282% jump in impersonation of the vetting platform itself is the cleverest vector in the report, because a call from “Highway” or “RMIS” or “your insurance agency” does not trip a driver’s alarm — it sounds like compliance, and carriers are trained to cooperate with compliance. So the rule is absolute: no credentials, no verification codes, and no carrier-packet documents go to any inbound contact, ever. If a platform genuinely needs something, it will be waiting in your account when you log in directly — through a typed URL or your own bookmark, never a link you were sent. And burn this one into everyone who answers a phone: a multi-factor code arriving on your device means someone is at your login screen right now. There is no legitimate reason on earth for a human to ask you to read one aloud.
Lock Five: Train Everyone, and Rehearse the First Hour
Your protocol is exactly as strong as your newest driver on a Saturday. Run a ten-minute briefing this week: what these scams look like, the callback rule, the never-read-a-code rule. Then write down your first-hour response plan so nobody is inventing it mid-crisis: reset passwords and kill all sessions on the compromised account; call your bank and factoring company to freeze any payment-detail changes; send written notice to every active broker and customer that instructions from you should be verified by phone at your known number; report the compromise to FMCSA and file a complaint at the FBI’s IC3; and document every step with timestamps for your insurer. Fraud losses compound in silence — the damage is done not in the breach but in the weeks it goes unnoticed and unannounced.
Bottom Line
The industry spent two years building walls around fake carriers, and the criminals answered by walking in through the mailbox wearing your face. Highway’s Q2 numbers say the fight has moved to your inbox and your phone line — which means, for once, the defense is actually in your hands. Five locks, one afternoon, almost all of it free. In a year when cargo losses run to nine figures, it is the cheapest insurance in trucking.
Questions Carriers Ask
How does freight fraud actually start if half of it begins with an email or call?
Fraudsters impersonate legitimate companies: they spoof a carrier’s email domain, clone a broker’s identity, or phone a shipper posing as a known contact to redirect loads or payments. The technical break-in matters less than the impersonation, so the defense is verifying identity through known channels, not trusting inbound contact. Every unexpected email or call about money or freight deserves an independent callback.
How do I keep someone from hijacking my carrier identity?
Lock down the channels fraudsters use: secure your FMCSA login and monitor your registered contact info for unauthorized changes, use unique passwords with two-factor authentication on email, register your own web domain rather than relying on free email, and check your profile regularly for edits you didn’t make. Also watch for lookalike domains impersonating your company to brokers. Early detection is the difference between a close call and months of cleanup.
What should I do if I think my MC number is being used by a fraudster?
Act immediately: report it to FMCSA, alert the brokers and factoring companies you work with so they flag suspicious traffic under your authority, and document everything. Change credentials on your FMCSA and email accounts, and file a complaint with federal fraud channels. The faster your regular partners know, the less freight and money moves under your stolen name. Consult a qualified professional for your situation.
Keep learning: Cargo Theft Losses Just Doubled to $304 Million While Thefts Fell 26%: What CargoNet’s Q2 Report Says About the Load in Your Trailer — and the High-Value Load Protocol to Run This Week and Shippers Just Got a 34-Page Playbook for Vetting Everyone Who Moves Their Freight: What the New BAVRA Standard Means for Small Carriers — and the Vetting-Ready File to Build This Week.
Innovative Logistics Group
