Every carrier in America was handed a new front door to their operating authority this year — FMCSA’s Motus registration system — and the criminals found it before most carriers finished setting up their login. At the NMFTA Cybersecurity Conference, Proofpoint threat researcher Ole Villadsen detailed a wave of phishing campaigns targeting carriers and brokers with fake login pages impersonating Truckstop, DAT, Highway, Central Dispatch — and Motus itself. The part that should change how you run your office: harvested usernames and passwords are not warehoused for later. “There’s someone on the other side looking at that,” Villadsen said. “They’ll use that information within a minute or two.”

The money behind the attacks is enormous. FBI data cited in the same reporting puts cargo theft losses at roughly $725 million across the U.S. and Canada in 2025 — up 60 percent in a single year — and the modern version of that crime starts with a stolen login, not a bolt cutter. The news is the warning; the rest of this article is the fix. Here is the No-Link Firewall: five locks a 1-to-10-truck carrier can set this week, most of them in under an hour.

What Is Actually Happening

FMCSA launched Motus on May 19 to replace its decades-old registration system, partly as a fraud-fighting tool — deputy administrator Jesse Elison has called it “critical to combat fraud.” But the rollout has been bumpy enough that the agency paused biennial-update enforcement in September, and that turbulence is exactly the weather scammers fly in. “They attack when there’s volatility, like the Motus rollout,” Truckstop principal product manager Shawn Rasmor told the conference. “Suddenly there’s emails that look like they’re coming from the government.” A carrier who is already anxious about losing authority to a registration glitch is a carrier who clicks.

The bait is specific. FMCSA’s own fraud alert describes emails with the subject line “Notice of Required Off-Cycle Update – Motus email” and a “New MOTUS Portal” button that routes to four lookalike domains: motusdatasboard.com, motusdatadesk.com, motuswebdeck.com, and motusfunction.com. None of them is the government. The only real portal is motus.dot.gov — and as Land Line noted, even the lettering is a tell: the scammers write MOTUS in all capitals, while the agency writes Motus.

A Stolen Login Beats a Stolen Load

Understand what the thief actually buys with your password, because it is worth far more than one trailer of freight. With your Motus or load-board credentials, a criminal does not have to steal from you — he becomes you. He can change the contact email and phone on your profile so that brokers verifying “you” reach him. He can book loads under your MC and authority, collect the freight, and vanish, leaving your name on the theft report. He can redirect payment information so your money arrives in his account. Every fraudulent-pickup scheme, double-brokering scam, and chameleon-carrier flip gets easier when the crook is operating from inside a legitimate carrier’s identity — and the two-minute turnaround Villadsen described means the damage often starts before you have closed the laptop.

For a small carrier, your clean authority is the single most valuable thing you own — more valuable than the truck. It is what shippers vet, what insurers price, and what took years to build. That is why this story matters more than one more theft headline, and why the defense below is worth an hour of your week.

Lock One: The Bookmark Rule

One rule kills this entire class of scam: nobody in your company ever reaches Motus, a load board, your factoring portal, or your bank through a link in an email or a text. Not once, not even when the email looks perfect — especially when it looks perfect. Today, bookmark motus.dot.gov and the real login pages for every platform you use, and make the bookmark the only road in. The rule covers everyone with a password: you, your spouse doing the paperwork on Tuesday nights, your dispatcher, your lead driver. An email that demands a login gets answered by opening the bookmark and checking the account directly. If the “required update” is real, it will be waiting inside. It never is.

Lock Two: The Sender Autopsy

Teach everyone in the office a thirty-second autopsy for any registration or login email. Hover over the link without clicking — does it resolve to a .dot.gov address, or to something like motusdatadesk.com? Check the lettering — MOTUS in all caps is a counterfeit signature. And weigh the tone: urgency plus a deadline plus the threat of losing your authority is the scam formula in its purest form. The federal government does not revoke operating authority through an email button, and right now FMCSA has biennial-update enforcement paused during the transition, which means any email claiming your registration lapses this week is lying by definition. When an email fails the autopsy, report it to the FBI at ic3.gov and delete it.

Lock Three: Harden the Five Accounts

Five accounts can be used to impersonate your company: Motus, your load boards, your company email, your factoring portal, and your bank. Each one gets a password used nowhere else and multi-factor authentication turned on — an authenticator app, not just a text message, wherever the platform allows it. A password manager makes the unique-password rule painless, and the whole job takes about thirty minutes. If a phished password is reused on your email account, the thief does not need to phish you twice; he resets everything else from your own inbox. We walked through the full credential cleanup in Cargo Thieves Hack First: Lock Your Logins — if you skipped it then, this news is the reason to run it now.

Lock Four: The Clicked-It Drill

Someone in your company will eventually click, and because the thief moves in minutes, your response has to be a drill, not a debate. The moment anyone realizes they entered credentials on a suspicious page: change that password immediately from a different, clean device, and sign out of all active sessions if the platform offers it. Call FMCSA’s contact center at 800-832-5660 if the account was Motus, and pull up your registration to confirm your address, email, phone, and process agent have not been changed. Then — within the same hour — warn the customers a thief would impersonate you to, before he does it:

That call costs you two minutes of embarrassment and buys you a customer who trusts you more, not less — you just demonstrated exactly the vigilance shippers are screening carriers for. Finish the drill by filing reports at ic3.gov and reportfraud.ftc.gov. If a load is ever stolen under your name later, that paper trail is the difference between being a documented victim and a suspect.

Lock Five: The Monthly Mirror Check

Once a month, look your company up the way a stranger would. Pull your own record on SAFER and FMCSA’s Licensing & Insurance site, and confirm that the address, phone, email, and registered agents are yours — then screenshot it and date the file. A changed contact field you did not change is the earliest visible symptom of a hijacked identity, and catching it in week one instead of month three is the whole game. Put the check on the same calendar entry as your UCR and biennial dates, right beside the registration self-audit we built in Chameleon Carrier Crackdown: Check Your DOT File — and remember the same lookalike-site discipline applies to fee season, as we covered in 2027 UCR Opens Oct. 1: Don’t Pay a Scam Site.

The Bottom Line

The registration system built to fight freight fraud has become the newest bait for it, and the thieves on the other end of a fake Motus email work in minutes, not days. You cannot out-react that speed — you can only make the click impossible to cash in. Set the bookmark rule today, harden the five accounts this week, rehearse the clicked-it drill with everyone who holds a password, and check your own mirror monthly. Your trucks can be replaced. Your name on a clean MC cannot.

Innovative Logistics Group