Account takeover (ATO)

FMCSA has named the hijacking of motor carrier accounts, and the selling of carrier numbers and PINs, among the fraud it sees in registration records. The usual path starts with phishing: a fake FMCSA email, a fake compliance notice or a stolen email password. With control of the FMCSA record or the carrier's mailbox, the attacker changes the phone and email on file so verification calls and confirmations reach them instead.

For a factor, takeover is hard to spot because every public check passes. The authority is old, the insurance is real and the safety record is clean, because they belong to a real company. Verisk CargoNet notes that compromised accounts can give criminals shipment details, contact directories and transportation software, letting them impersonate trusted parties while appearing legitimate.

The defense is to verify the person and the bank account, not just the authority. CarrierKYC's Verified Payee checks that the applicant controls the carrier and that the account belongs to it, and re-verifies every bank or ownership change before the next ACH. See carrier identity theft.