Freight fraud prevention checklists for brokers

Minutes are our estimates for one experienced rep. Not legal advice: following these lists does not guarantee insurance coverage, compliance or any outcome in court.

1. Your email domain

Once, then monthly. Setup takes 2 to 6 weeks because you first have to find every service that sends mail as you.

• List every service that sends email as you: Google Workspace or Microsoft 365, TMS, load board, e-signature, accounting, CRM, website forms
• Each one passes SPF or DKIM for your domain
• DMARC published at p=none with a reporting address (report-only, nothing blocked yet)
• Reports read for 2 to 4 weeks, failing legitimate senders fixed
• Moved to p=quarantine
• Moved to p=reject once reports stay clean
• Monthly: any new sender failing in the reports? (10 min)

2. Lookalike domains

Monthly, 10 minutes.

• Typical patterns checked: swapped letters, rn for m, added -llc or -logistics, .co instead of .com
• The 3 to 5 most obvious lookalikes registered by you and pointed at your website
• On lookalikes you own and don't send from: SPF -all and DMARC p=reject
• Monthly scan for new ones with free tools (dnstwist, certificate search at crt.sh)
• A lookalike used against you is reported to its registrar's abuse contact (shown in RDAP lookup)

3. Your FMCSA record and Motus

Monthly, 8 minutes.

• SAFER snapshot: phone, email and address are yours (3 min)
• MCS-150 date is recent
• Motus: you know who your Company Official is
• Motus users reviewed, nobody unknown (5 min)
• Login.gov account on a company email, with multi-factor authentication
• Everyone knows the only real address is motus.dot.gov
• Everyone knows: nobody from FMCSA or a vendor ever needs your Login.gov code

4. Your team and accounts

Once, then for each new hire. About 30 minutes.

• Everyone who books loads has run the fraud drill: retexa.ai/drill
• Each new hire runs the drill in their first week
• Multi-factor authentication on email, TMS and load boards
• No shared logins
• Monthly: mailboxes checked for rules nobody set up (forwarding outside, auto-delete, hidden folders)
• Remote-access tools your IT didn't approve are blocked
• Rule everyone knows: never share a login code, whoever asks

5. Your website and your carriers

Once, then quarterly. About an hour the first time.

• MC, USDOT and the phone shown in SAFER are on your website, email signature and rate cons
• A "Verify it's us" page on your own website: your only email domains, main line, what you never ask for, how load changes work. The safety sheet generator builds it too
• Carriers have a printed safety sheet with your details. Make yours free in 2 minutes: retexa.ai/safety-sheet
• The sheet is in every onboarding packet
• The sheet goes with the first rate con to each new carrier
• Visor cards handed to drivers who run your lanes often
• Reprinted when your phone or domain changes

6. Carrier vetting before you book

Every booking, about 15 minutes.

• Called back on the phone number in FMCSA SAFER, not the number that called you or the one in the email (4 min)
• Email domain matches the carrier's record, and the display name matches the real address (3 min)
• Authority is active, not just issued (2 min)
• Insurance on file, inspections reviewed (2 min)
• No contact changes on the FMCSA record in the last 90 days (2 min)
• Truck VIN or unit count matches the MCS-150 (2 min)
• SAFER shows no phone at all: don't book until you confirm the carrier another way
• Check logged with the time and your name

7. High-risk loads and cargo theft prevention

Add to checklist 6, about 15 more minutes. A load is high-risk if any of these is true: high-value or easy-to-resell freight (electronics, copper, meat, seafood, beverages), the first load with a new carrier, a booking late on Friday or before a holiday, a carrier who takes it far below market or agrees to a higher rate too fast.

• Insurance confirmed with the agent or insurer, not from the certificate the carrier sent (5 min)
• Asked another broker, or checked the carrier's reviews in a directory such as DAT (5 min)
• Driver's name and cell, tractor and trailer numbers collected before the pickup number goes out
• A second person looked at any end-of-day tender (5 min)
• One red flag: asked about it and noted the answer
• Two or more red flags: stopped and escalated before anything went out
• New MC: one low-value load first, wait for a clean delivery and verified POD

Red flags: the rate con reply comes from another domain, a VoIP phone or one that differs from FMCSA, contact changes in the last 90 days, authority under a year old or reinstated, pressure ("send the PU number now", "the driver is already there"), links to "sign" something or "check a review".

8. Pickup and in transit

Every load, about 10 minutes.

• Rate con sent only from your domain or TMS, with the load number
• Shipper told who to expect: carrier, driver, plates
• Pickup number released only after truck and driver are confirmed
• At the dock: MC or USDOT on the door, plates and driver ID match the booking
• Photos of truck, plates, door markings; seal number recorded
• Anything differs: the load waits
• Tracking through ELD or a tracking app, not texts from the driver's phone
• Pings stop: call the carrier on the number you verified
• Any change of address, driver or truck: only after a call on your verified line plus a revised rate con from your system

9. How to prevent double brokering at delivery

Every load, about 3 minutes.

• POD comes from the carrier you booked
• Piece count and seal match
• New carrier: no more loads until a verified POD
• Watch for double brokering: a different MC or name on the truck door, a driver who can't say who dispatched them, a second invoice with a quick pay request, a request to change the payee or factoring company mid-load, a POD from an address that didn't book the load
• Any of these: hold payment and call the carrier you booked on its verified number

10. Bank detail change

Every change, about 15 minutes.

• Change came through your portal or TMS form, not by email or phone alone
• Called back on a number that was in the carrier's file before the request, not the number in the request
• SAFER phone changed recently: callback proves nothing, escalate
• Second person approved
• First payment to the new account held 48 hours
• Recorded: who called, which number, where that number came from, who approved
• New NOA or NOA release confirmed with the factoring company, using contacts from its website
• Changes to the carrier's login, MFA device or recovery email handled the same way
• Quick pay only for carriers with clean loads behind them

11. The first hour after an incident

When it happens. Three jobs: stop the money, keep the data, get a police case number.

Load picked up by the wrong carrier, or gone silent

• Called the carrier and driver on verified numbers
• Tracking data and last ping saved before anything overwrites them
• Police report where the pickup happened, case number written down
• Shipper and insurer told
• Within 24 hours: IC3 report, CargoNet if you're a member, MC flagged with your load boards

Load held for more money

• No new rate con sent unless you're ready to pay it, since it is a new commitment. Talk to counsel
• Police, shipper and insurer told
• Every message and call saved

Payment sent to a fraudster's account

• Bank called for a recall of the transfer
• Police and IC3 reports filed: speed matters for getting money back
• Insurer told
• Checklist 10 reviewed: how did the change get through?

Someone is booking loads in your name

• Impostor's domain, phone numbers and load details written down
• Your carriers warned (template below)
• Load boards asked to remove the impostor's postings
• Surety (bond) company and insurer told
• Lookalike domain reported to its registrar
• Warning posted on your website

Your FMCSA or Motus record was changed

• Login.gov locked: new password, MFA devices checked
• FMCSA contacted, SAFER checked for what changed
• Carriers and factoring companies warned
• Motus users rechecked

With police, use plain words: theft, fraud, impersonation. Industry terms like double brokering or BOL slow the report down.

12. Contacts to fill in now

Once, 20 minutes. Fill this in before you need it and pin it next to checklist 11.

Templates

To your carriers, when someone is using your name:

Subject: Fraud warning: someone is using our name

Someone is booking loads while pretending to be [Company], MC [number].
We only email from @[domain]. Our main line is [phone], the number on our FMCSA record.
If you got a load from any other address or number, it is not from us. Don't move it, and call us on [phone].

To the shipper, when a load is missing:

Subject: Load [number]: pickup by an unverified carrier

Load [number], picked up [date] at [location], has not reached its next checkpoint.
We have reported it to police (case [number]) and notified our insurer.
We will update you by [time]. Your contact on our side is [name, phone].

To a factoring company, about an invoice you didn't issue:

Subject: Invoice [number] was not issued by [Company]

You received invoice [number] for load [number] in our name. We did not issue it.
Please don't pay it, and send us the sender's details for our police report (case [number]).

Share these checklists freely. Train your team on real scenarios at retexa.ai/drill. Make a safety sheet and a "Verify it's us" page for your carriers at retexa.ai/safety-sheet.