How to prevent cargo theft before peak season without buying fraud software

The two highest-leverage steps a broker or shipper can take before peak season cost nothing. Hold the pickup number until you know who's coming, and pull carrier records from the issuing source instead of accepting what the carrier sends. Both steps close gaps that fictitious pickups depend on, and fictitious pickups held steady this year while overall theft fell.

Verisk CargoNet recorded 677 cargo theft incidents in Q2 2026, down 26% from a year earlier (Verisk CargoNet, Q2 2026). Fictitious pickups only slipped from 165 to 158, which by our math is roughly 23% of recorded thefts for the quarter. Estimated losses more than doubled to $304.6 million, and the average theft was worth $564,009. Peak season then adds heavy volume, thin staffing and rushed releases, and CargoNet says theft activity typically intensifies in Q4 and peaks in December. Its most recent holiday data counted 79 thefts in the 2024 Thanksgiving window, up from 48 the year before, with $9.5 million stolen (Verisk CargoNet Thanksgiving alert, November 2025).

Fictitious pickups pass carrier vetting because the carrier is real

In a typical version of the scheme, the trouble starts at tender with an offer to haul from a real carrier's real inbox. The thief bought that email login on the dark web. The MC number is active, the authority is current and the insurance is on file. Every carrier check comes back clean, because the carrier itself is legitimate.

At dispatch, the "dispatcher" texts over a driver name and a CDL photo that may have been generated with AI or doctored in minutes. A visual check has no way to tell the difference. The thief already has the pickup number, because it went out with the rate confirmation. At pickup, a truck arrives with a magnetic decal of the carrier's name stuck over the real one on the door, and the dock loads it. The real carrier only learns about the load when someone calls asking where it is.

A carrier check confirms who owns the truck, but it can't tell you who is driving it. Our guide to the types of freight fraud that pass carrier vetting walks through why most schemes exploit that gap. Since May 2026, FMCSA's Motus registration system has required applicants to prove their identity with a government-issued ID and a facial scan (FMCSA). That tightens who can get authority, while doing nothing to confirm who arrives at the dock. Peak season widens the gap, because thieves can count on busy desks releasing pickup numbers faster than anyone can check them.

Step 1: Hold the pickup number until you know who's coming

Most fictitious pickups need the pickup number, and many brokers send it with the rate confirmation at tender. That can be hours or days before anyone knows which driver is coming. Move the release to the end of a step the driver has to complete, such as confirming their name, CDL, tractor and trailer numbers with your team. The number then goes to the person you expect rather than whoever has the email. Legitimate drivers benefit too, since many show up today without a pickup number because the release process is informal.

Once the driver is confirmed, send the shipper the driver's name, the tractor and trailer numbers and the carrier name that should be on the door. That gives dock staff a reason to stop a truck whose details don't match. The dock is the last place anyone can catch a thief before freight is loaded. Some shippers limit what driver information they can receive or what dock staff can record. Agree before peak on what gets shared, through which channel, and who at the dock checks it against the truck.

On high-value or theft-prone loads, a live video call with the driver standing at the truck is the most dependable manual check we've come across. Before the pickup number goes out, ask the driver to show their face, the tractor, and the carrier name and unit number on the door. Pay attention to the door, because one pattern we see repeatedly is a magnetic decal stuck over the real carrier name. Keep the call to identity and the truck, and run it from the same short script every time. Don't use it to collect anything the check doesn't need.

After each check, log who ran it, when it happened, what matched and whether the number was released. Asking for ID ad hoc over the phone or by text creates legal exposure without making anyone safer, which is why a fixed script and a written log matter more than the call itself. A log won't turn a video call into an audit trail on its own, but it gives you a dated note of who checked what if a load is disputed. Our post on why driver conversations are now evidence explains what that record means for a broker's liability.

Step 2: Get proof from the issuing source instead of the carrier

A PDF certificate of insurance or a screenshot of authority sent by the carrier proves only that someone had access to a file. A thief inside a real carrier's inbox has access to all of them. Pull operating authority from FMCSA's SAFER Company Snapshot and the insurance on file from its Licensing and Insurance system. Then confirm coverage with the insurer or agent listed there, rather than the contact printed on the certificate. During peak, run that check on every load, including carriers you've used for years, because an account takeover turns a trusted carrier into the easiest way in.

When an email asks you to change something, call back on a number you already had on file, never the one in the email or its signature. CargoNet named business email compromise as a main access point for thieves in Q2 (Verisk CargoNet, Q2 2026). The FBI's Internet Crime Complaint Center similarly advises using a secondary channel to confirm any request to change account information (IC3 public service announcement on business email compromise). A compromised inbox sends from the real domain with the real signature, so the email itself can't tell you whether to trust it.

Last-minute changes to pickup or delivery instructions are where a thief inside an inbox does the most damage. A new address or a new driver can reroute a load that already passed every check. Decide before peak who has the authority to approve those changes, and send every change through that person. Require a callback to the number on file before anything is updated in your TMS. A single approver also sees the full pattern of requests, which makes it easier to notice when one carrier keeps asking for changes.

A written SOP keeps both steps running on the busiest day of the year

These steps only protect you if they run the same way in a quiet week in spring and on the Wednesday before Thanksgiving. That takes a written SOP rather than good intentions from a stretched team. When the Transportation Intermediaries Association updated its Carrier Selection Framework in 2023 in response to rising fraud, it said a consistent carrier selection process helps members avoid fraudulent carriers. An SOP your whole desk follows is also easier to defend to a shipper or an insurer than a process that lives in one person's head. At a minimum, it should name:

• which loads get the video call, by commodity, value or lane
• when the pickup number is released, and who releases it
• what the shipper receives before arrival, and through which channel
• where authority and insurance are pulled from, and how often
• who approves instruction changes, and the callback rule they follow
• what gets logged after each check, and where the log is kept

We've seen what consistency does from the thief's side. At a high-value automotive shipper we work with, people from one area kept trying to get loads with doctored CDLs. After about a month of being turned away every time, the attempts stopped. A gate that stays closed to a convincing story pushes thieves toward easier freight. For controls on the most targeted loads, see how to protect high-value freight when thieves don't need to break in.

Manual checks stop scaling when volume peaks, which is the part we automated

Run properly, these steps will slow your team down at exactly the moment it has the least time to spare. A video call on every load doesn't scale with a thin desk, and notes typed after a call vary with whoever took them. Nobody on a call can tell an AI-generated CDL photo from a real one, or check that the barcode on the back of a card matches the front.

E3 driver authentication automates step 1 on every load. When a driver is assigned, they get a text link and take live photos of their CDL, the truck and their own face through their phone's camera. The pickup number goes out only after they pass. As the driver approaches a geofence around the pickup point, we authenticate them again before the number is released. That recheck is how a switch-out gets caught when someone other than the authenticated driver arrives for the load. Every result is stored with the load, so your SOP produces an audit trail your legal team can stand behind. It plugs into your TMS and can be running in a day, and across more than 700,000 authenticated loads, our customers have had zero stolen loads.

Before November, write both steps into your SOP, decide which loads get the video call, and name the one person who approves instruction changes. To see how E3 driver authentication releases the pickup number only after the driver passes, book a demo of E3 driver authentication.

Frequently asked questions

What is a fictitious pickup?

A fictitious pickup is a cargo theft in which a thief collects a load in person while posing as the legitimate carrier or driver, usually using a real carrier's identity and a convincing CDL. The freight is handed over willingly at the dock, so nothing is broken into.

Can a broker ask a driver for ID without taking on liability?

Ad hoc ID requests by phone or email create exposure without much protection. A narrow identity step that runs the same way on every load under a written SOP, with the result logged, is easier to defend than one-off calls. Our post on driver conversations as evidence covers this in more depth.

Is checking a carrier's MC number and insurance enough to prevent cargo theft?

No. Those checks confirm the carrier is real, but in many fictitious pickups the carrier is real and its identity has been borrowed, so the checks pass. You also need to confirm who is arriving for the load before the pickup number goes out.

Which loads need a video check before the pickup number is released?

Start with high-value and theft-prone freight, meaning the commodities your team has seen targeted, and write the criteria into your SOP so the decision doesn't depend on who's working the load that day.