Compromised Communications Tied to 40% of Stolen Loads in Highway Q3 Fraud Report

Compromised communications accounted for 40.2% of stolen load reports in Highway's network during the third quarter of 2026, the carrier-identity verification company's latest Freight Fraud Index shows. The finding, covering July through September, points to a threat that operates after carriers pass onboarding: criminals breaking into carrier email accounts and requesting shipment details from familiar, trusted addresses.

The quarterly signals around identity fraud intensified. Highway recorded 518 carrier ownership change reports, up 111.4% from the second quarter and 12.4% year over year. Fraudulent and spoofed calls blocked by its systems climbed 90.3% year over year.

Stolen load reports fell to 184 incidents, a 28.1% quarterly decline, though the figure remained 8.2% higher than the same period in 2025. Highway cautions that its numbers reflect activity within its own network, not nationwide cargo theft totals.

What cut the stolen-load count?

Highway attributed part of the decline to stronger verification inside its network, including wider adoption of authenticated rate confirmations and additional identity checks before releasing shipment information. But the company warned against crediting any single measure. Its core message to brokers: verify the individual accessing shipment information, not just the carrier.

Emailed rate confirmations remain a specific vulnerability. Once criminals compromise a carrier inbox, they can read shipment details — a risk that persists well after a broker approves a legitimate carrier.

Direct theft by real carriers keeps rising

Highway documented cases where carriers accepted legitimate shipments and then stole the freight themselves. Direct theft incidents fell 16% quarterly, but their share of reported stolen loads rose from 31.3% to 36.4%. Some operators collected multiple loads over several days before brokers discovered the freight was missing.

These cases are hard to catch. The carriers involved may carry established operating histories, legitimate equipment and trusted broker relationships, so pickups look routine. Few warning signs precede the theft.

Real credentials, different people

Criminals exploit established motor carrier authorities to obtain freight under recognizable identities. A federal cargo theft case involving more than $12 million illustrates the stakes: prosecutors allege conspirators took control of established trucking companies and impersonated previous owners to secure shipments.

Alyssa Fleury, director of operations at PEI, a Griffin, Georgia brokerage, described the problem in written comments. "A carrier can look great on paper, with established authority and a clean history," she wrote — yet the people currently operating under that authority may not be its previous owners. Her team has hired one carrier only to find a different trucking company arriving for pickup, triggering checks of operating authority, insurance and the relationship between the businesses.

Highway also found some buyers paid sellers to falsely confirm that ownership had not changed. Even so, thefts associated with sold authorities fell from 21.1% to 7.1% of reported incidents, a decline Highway credits to its ownership verification checks.

What does the 87% CDL figure actually show?

Highway reported that 87% of direct theft events involved carriers with at least one user whose records included a non-domiciled or limited-term CDL designation, measured across the preceding 90 days. The company could not say how often that verification history appears network-wide, so the figure cannot establish disproportionate risk. Nor does the association prove flagged users transported or stole the shipments.

Highway estimates targeted screening of non-domiciled and limited-term CDLs reduces available carrier capacity by roughly 7%, assuming brokers restrict higher-risk states over a defined historical window. FMCSA's non-domiciled CDL rule, effective March 16, 2026, limits foreign-domiciled applicants to H-2A, H-2B and E-2 classifications — separate from Highway's fraud findings, which do not establish that non-domiciled CDL holders are more likely to commit cargo theft.

Thousands of shared records

Highway identified 22,020 vehicle identification numbers appearing on insurance certificates for multiple carriers; 975 appeared across at least three authorities and 104 across five or more, with one VIN tied to 15 companies. It also flagged 5,336 identity documents linked to multiple user accounts, 746 of them connected to more than one carrier authority. Shared records don't automatically signal fraud — leasing, affiliates and clerical errors produce legitimate overlaps.

California remained the top pickup location for reported stolen loads, accounting for nearly half of incidents, followed by New Jersey and Texas. General merchandise, electronics and bulk commodities were the most targeted freight. Colombia, India and the Philippines led blocked foreign sign-in origins, though criminals can disguise connection locations. Highway blocked 670,230 fraudulent inbound emails, up 10.6% year over year, and logged 15,491 unauthorized FMCSA contact changes, up 12.7% from Q2.

Looking ahead, Highway expects holiday shipping demand to create openings for thieves in Q4, with tighter capacity pressuring brokers to skip verification. Its guidance: confirm authorized contacts, check driver information and document exceptions before releasing shipments — especially on urgent night and weekend bookings.