Carrier identity theft in 2026: takeovers, PIN phishing and Motus

Carrier identity theft is when someone poses as a real, established motor carrier, using its name, USDOT and MC numbers, insurance and safety history, to win loads, collect payments or draw factoring advances that belong to that carrier. The victim usually has a clean record, which is the point: its history is what makes the fraud believable. For a factor, the risk is funding an impostor in the real carrier's name, or paying a real client's money to someone who has taken over its accounts.

It comes in two forms, and they need different checks.

The second form is harder to catch, because every lookup you run agrees with the fraudster. The glossary entry on account takeover covers the short version.

Because established identities pay better and pass more checks. A carrier with eight years of authority, active insurance and no revocations clears the screens most brokers and factors run, so borrowing that identity is worth more than building a fake one.

The data points the same way, with the caveat that most of it is broker-side. Highway's Q2 2026 Freight Fraud Index (vendor data from a broker-focused platform) reports that communication-based attacks were 50% of classified fraud vectors that quarter, up from 42.7% in Q1, and that ownership-change fraud was 25.6% of reported thefts.

The FBI's April 30, 2026 public service announcement on cyber-enabled cargo theft says actors gain access "typically via spoofed emails, fake URLs, and compromised carrier accounts." It describes them changing the legitimate carrier's contact information with FMCSA and updating its insurance information, and it puts estimated cargo theft losses in the US and Canada at nearly $725 million in 2025.

Cargo theft isn't factoring fraud, but the techniques are the ones that reach factors: a real carrier's identity, contact details changed in the public record, and a request that looks routine.

The attack starts with the carrier's own registration access. Fraudsters send emails that look like they come from FMCSA or USDOT, asking the carrier to update a filing, pay a fee or confirm details, and collect login credentials, Social Security numbers or the carrier's USDOT PIN. In a February 2026 alert reported by J.J. Keller, FMCSA said it never solicits sensitive information such as Social Security numbers, bank details, UCR payments or PINs through unsolicited emails or phone calls.

With access, the fraudster changes the carrier's phone, email or address on its registration. Writing for FreightCaviar in 2024, Tom Croteau of OperFi described scammers phishing USDOT PINs and then changing carriers' contact information with FMCSA. Transport Topics' May 2026 coverage of Motus lists "Hijacking FMCSA motor carrier accounts" and "Selling motor carrier numbers and personal identification numbers" among the types of registration fraud FMCSA reported.

This is the part that catches factors. After the change, anyone who verifies by calling the phone number on the FMCSA record reaches the fraudster, and the email on the record belongs to the fraudster too. Contact details on a public registration are self-reported and can be changed by whoever controls the account.

Motus is FMCSA's new registration system, and it changed how new carriers prove who they are. FMCSA's April 29, 2026 Federal Register notice says that "all new applicants will be required to pass identity proofing and verification," and that Motus replaces the Unified Registration System in phases. Transport Topics reported that Motus launched for registrants on May 14, 2026.

DAT's summary of the launch says new registrants verify identity with a government-issued photo ID and a facial scan, handled by FMCSA's partners IDEMIA and CLEAR. The Company Official "must be the company owner or an authorized internal employee," not a third-party service. Existing carriers claim their USDOT number in Motus through a Login.gov account whose email matches the Company Official on file.

Transport Topics also reported built-in checks: Motus is meant to stop someone claiming another company's registered legal name, and it can flag applications that share an address, company official name or phone number. Three things did not change, and they matter to factors:

• MC numbers still exist. The Federal Register notice excludes eliminating MC and FF numbers from this release, and retiring them would take a future rulemaking. Keep collecting and matching both USDOT and MC numbers; is the MC number going away? has the detail.
• Legacy data stopped updating. The legacy L&I datasets on data.transportation.gov froze on 2026-05-14. The Carrier dataset's own description says it "was last refreshed on 05/14/2026 and will no longer be updated," so any tool still reading only those files is showing you a May snapshot.
• Identity proofing happens at registration, not at your desk. Motus can confirm who registered or claimed a carrier. It can't tell you who is emailing your verification team today, or whether the carrier's mailbox has been compromised since.

Our read: making fake new authorities harder pushes fraudsters further toward established identities, which is the pattern factors already see. For the full picture of the system, see FMCSA Motus explained.

It rarely looks like fraud. It looks like a good carrier that wants to move fast. These are the common shapes.

A new application in an established carrier's name

The applicant presents a real carrier with years of authority and clean inspections, but applies from a free email account or a domain registered last month. The mobile number doesn't match older records, the bank account is new or in a personal name, and funding is needed today.

A compromised existing client

Your real client's mailbox is taken over, and an email from the address you've always used asks to change the bank account before Friday's advances. This attack has its own SOP in how to verify a remit-to or bank-account change.

A "new owner"

Someone says they bought the company, the officer on file is gone, and the phone, email and bank all need to change. Some ownership changes are real, and all of them need the checks in change-of-ownership fraud.

Treat the FMCSA record as the claim and everything else as the proof. The steps below run roughly cheapest first.

1. 1

   Pull the carrier's public record

   Run the carrier risk check for authority age, status, insurance and other carriers sharing the same phone, email or address. Note the officer names and contact details on file, and when they last changed if your tools show it.

2. 2

   Match the applicant to an officer of record

   The person applying should appear as an owner, member, manager or officer on the Secretary of State record for the legal entity, or as the company officer on the FMCSA record. A "dispatcher" or "office manager" applying on the owner's behalf is a reason to slow down.

3. 3

   Prove the person is who they say

   Check a government ID against a live selfie or a video call, and match the name to the officer of record. Croteau's factor-side account recommends video calls and pictures of people holding their IDs, and treats refusal as a warning sign.

4. 4

   Call back through a channel the applicant didn't give you

   Use a number from an older record, the carrier's insurance agent, or a broker the carrier has hauled for. Ask whoever answers whether the company is applying with you.

5. 5

   Check the email domain and the signing session

   Look up when the email domain was registered. The same FreightCaviar article suggests checking the IP addresses used to sign contracts for VPN use, which can show whether the signer is really in the stated state.

6. 6

   Prove the bank account belongs to the carrier

   The account holder name should match the carrier's legal name. A voided check doesn't prove ownership; the remit-to SOP compares the methods that do.

7. 7

   Check liens and prior factors

   An established carrier with no UCC history is worth a question, and an undisclosed prior factor is worth several. See UCC searches before funding.

Move fast, and move through channels you trust. A hijacked carrier is usually a victim, and the fraudster may still be inside its email.

1. Freeze all payee, contact and ownership changes on the account, and hold payments to any bank account added recently.
2. Re-verify the officer's identity before taking instructions, even if the call comes from the number you've always used.
3. Reconfirm your NOA with each debtor, and ask whether anyone has asked them to change the carrier's remit-to.
4. Have the carrier contact FMCSA through official channels to restore its registration. J.J. Keller's report of FMCSA's alert gives the FMCSA Contact Center number as 1-800-832-5660.
5. File a complaint at ic3.gov, which the FBI's cargo-theft alert asks victims to do.
6. Write down everything: who called, from which numbers, what changed and when. The carrier will need it, and so will your file.

Identity is not a one-time check. A carrier that was clean at onboarding can be taken over later, and the attack usually arrives as a routine request: new email, new phone, new bank.

Set triggers rather than calendars. Re-verify the person whenever the carrier's bank account, ownership, officer or primary contact changes, whenever its FMCSA contact details change, and whenever a debtor tells you it was asked to pay someone else. The FBI's alert gives brokers the same advice in their terms: independently verify shipment requests and pickups through secondary methods before releasing loads.

Trigger-based re-verification is what CarrierKYC's Verified Payee is built for. It's in early access: every bank or ownership change is re-verified against the officer who passed onboarding before the next ACH goes out, and pilots are open to small factors who want to try it on real files.