Inside a call with a freight scammer: the moment a stolen load was confirmed

A weekend conversation revealed how identity misuse and communication control are reshaping cargo theft risk.

Convoy’s new system aims to combat cargo crime. (Photo: Convoy)

Freight fraud rarely begins with obvious deception. It begins with conversation. A phone call over the weekend provided an unusually direct window into how modern freight fraud operations are functioning today. The discussion started like thousands of routine freight calls that occur across the industry every day. A name was introduced; a shipment lane was referenced and there was discussion of a load already in transit. At first, nothing appeared unusual. Within minutes, however, inconsistencies began to surface that experienced investigators would recognize as early warning signs.

The individual on the phone claimed to be connected to a carrier operating under a legitimate authority. When asked basic verification questions about the driver and equipment, the responses became vague. Instead of confirming details directly, the caller shifted toward reassurance. “It’s going to get delivered on Monday,” the individual said when questioned about the shipment status. When pressed to identify the actual carrier moving the freight, the answer changed. “I can’t give you that information right now.” The explanation for payment created further confusion. “That’s the way I work, sir. I can’t tell you all the details… but I’m going to get paid.”

When someone cannot clearly explain how a transportation transaction is structured, it often indicates that the structure itself may not be legitimate. As the conversation continued, questions became more direct and the individual began revealing fragments of information that did not align with normal brokerage or carrier relationships. The tone gradually shifted from confident reassurance to partial disclosure.

The moment that confirmed the situation occurred when the individual was asked directly whether the shipment would actually be delivered. After a pause, the response came: “Honestly… it’s gone.” The freight had already been removed from the supply chain. Moments later, the confirmation became more explicit. “Yeah, it’s gone for sure.” What followed was an unusually candid discussion that provided insight into how freight fraud schemes are evolving.

Stolen identities and communication control

One of the most significant admissions involved the use of another company’s identity and communication systems. The individual described operating under a legitimate carrier’s authority and email environment, stating, “We also had it… we had their email.” Stolen carrier identities have become one of the most dangerous vulnerabilities in freight logistics because they allow criminal actors to appear legitimate long enough to obtain physical control of shipments. Once freight is released under a compromised identity, recovery becomes next to impossible.

Perhaps even more concerning was the discussion around communication interception. The individual explained that verification calls intended for legitimate carriers could sometimes be redirected. “We can sometimes get the call instead of the carrier.” When asked to clarify, the response was immediate. “Yeah, that’s right.” This suggests the use of call forwarding, number spoofing or routing manipulation and represents a meaningful escalation from traditional double brokering, where deception relied primarily on documentation gaps rather than control of communication channels.

How freight fraud tactics are evolving

The caller also described how tactics have changed over time. Earlier activity focused on rebrokering loads using legitimate authorities for payment arbitrage rather than cargo theft. “I was just double brokering back in the days… getting the loads with legit MCs and selling it to a carrier,” the individual said. Increased monitoring and reporting pressure appears to have pushed some actors toward direct cargo theft instead. “There were brokers trying to catch you… that’s why we’re doing this now.” This progression from payment manipulation to freight liquidation reflects patterns investigators have observed across multiple recent incidents. When fraud detection improves in one area, criminal actors often adapt rather than exit.

The conversation also revealed how commodities are selected. When asked why the shipment had been targeted, the individual responded directly, “Yeah… it’s easy to sell on the second market.” Commodity liquidity remains one of the strongest predictors of cargo theft risk. Products that can be resold quickly create immediate financial incentive and reduce exposure for criminal actors. The caller even provided an estimate of frequency. “Sometimes two a day. Sometimes none in a week. Depends.” While that claim cannot be independently verified, it aligns with broader concerns about the scale at which organized freight fraud operations may be functioning.

Interactions like this are particularly instructive because of the behavioral shift that often occurs once exposure is acknowledged. Criminal actors frequently become more open after a loss is confirmed because operational risk has already passed. That openness should not be mistaken for cooperation. The more important takeaway is what the conversation reveals about how freight fraud is changing.

This is no longer primarily a documentation problem. It is an identity and communication problem. Verification failures do not typically occur because information is unavailable. They occur because the information appears credible long enough for freight to be released under a compromised identity. Once that happens, recovery becomes significantly more difficult.

Preventing exposure before freight moves

As incidents like this continue to surface, prevention depends less on reacting after anomalies appear and more on strengthening identity controls before freight moves. One of the most important protections is securing communication channels. Email compromise remains one of the primary entry points for fraudulent carrier impersonation. Multi-factor authentication should be enabled on all operational email accounts, particularly those used for carrier setup, dispatch coordination and load tendering. Single factor email access creates unnecessary exposure in an environment where credentials are frequently targeted.

Communication security also plays a critical role once a load is booked. Sensitive documents such as rate confirmations, pickup instructions and shipment details should be transmitted through controlled channels whenever possible. End-to-end encrypted platforms reduce the risk of interception, forwarding or unauthorized access compared to open email workflows, especially when identity questions arise during active shipments.

Beyond technology, process discipline remains essential. Verification should not occur only during onboarding. Identity confirmation at multiple points, including before dispatch and prior to delivery, significantly reduces the likelihood of compromised shipments.

The conversation ultimately reinforces a simple reality. Fraud prevention in freight is no longer just about documentation. It is about controlling identity, communication and verification at every stage of the transaction. As freight fraud continues to evolve, companies that prioritize verification discipline will be better positioned to prevent losses before freight moves.

Confidence in freight decisions does not come from assumptions. It comes from verification.

Phil Brink

Phil Brink is the Head of Fraud Media and Education at FreightWaves and the CEO and co-founder of The Bannon Report, a freight risk intelligence platform that helps companies verify partners and prevent losses before freight moves. He began his logistics career in 2013 and spent more than a decade owning and operating a brokerage, where firsthand exposure to organized cargo theft and fraud led him to develop prevention solutions for the industry. His work focuses on cargo theft trends, identity risk, and emerging threats across the transportation ecosystem. Reach him at phil.brink@firecrown.com.