What a decade in security taught me about freight fraud

For ten years, while I was building toward freight, my day job was cybersecurity. I worked in security operations centers on monitoring and response and on incident response, first with the Department of Defense at Fort Belvoir and the Pentagon, then with a leading California utility serving more than 20 million people. The work was protecting critical infrastructure. On my watch, there was no compromise.

I am not going to tell war stories here. What I want to share is the mindset, because freight fraud and network attacks are the same problem wearing different clothes. Neither one is really about technology. Both go after trust and urgency.

The patterns everyone in freight knows

These are widely known, and if you have been in the industry for a while you have seen most of them.

Carrier identity theft. Someone poses as a real, reputable carrier using its name and paperwork, gets dispatched on a load, and the freight never arrives. The real carrier had no idea its name was being used.

Double brokering. The carrier that accepted the load quietly hands it to another carrier. The shipper does not know who has the freight, the broker has lost control of it, and the truck that actually hauled it often struggles to get paid.

Fake load postings. A posting that looks like a normal load, built to harvest a carrier's details, collect a bogus fee, or set up a theft.

Phishing of dispatch and accounting inboxes. An email that looks like it came from a known broker, carrier or factoring company asks you to update banking details, send a document, or click a link. The money goes to the wrong account, or the credentials walk out the door.

The habits that work

Verify before you trust. New carrier, new contact, new bank account. Confirm it through records you look up yourself, not the ones that were sent to you. The whole point of the fraud is that the documents look right.

Call back on a number you already have. If a request to change payment details or reroute a load shows up by email, do not reply to it and do not use the contact details inside it. Reach the person you already know, on a number you already have. This one habit stops a lot of inbox fraud.

Check the paperwork against itself. Rate confirmation, bill of lading, proof of delivery, insurance certificate. Do the names, addresses and email domains agree with each other and with the carrier you actually booked? A domain that is one letter off is a classic tell.

Slow down when someone speeds you up. Urgency is the oldest trick there is. A legitimate partner can wait ten minutes for you to confirm. A fraudster cannot.

Two people on every change. The person who requests a banking change should never be the person who approves it. It is a little slower, and it is worth it every time.

Treat the inbox as the front door. Multi-factor authentication on email, a habit of checking where a link goes before clicking, and healthy suspicion of unexpected attachments. Most freight fraud starts in an inbox, not on a dock.

Say something when it looks off. Good security teams make it safe to report a near miss. Nobody got blamed for raising a flag that turned out to be nothing. Do the same in your office. The one time it is real will pay for every false alarm.

Same job, different building

In security, the measure of the work was simple: no compromise on your watch. In freight the goal is the same. The load gets where it is going, the right carrier gets paid, and nobody's inbox becomes the weak point.

Verify before you trust. It is cheap, it is boring, and it works.

Stay safe out there. Sunny