A carrier you correctly qualified can still be the one that loses your load — the compliance portal it logs into is now being phished, and CBP just asked 64 questions about paperwork your suppliers have never given you

Week of September 16, 2026 · 3 items · 8-minute read

1. Your carrier-vetting file cannot catch this theft pattern — the carrier is legitimate, the account is not

Cargo theft prevention has been sold to procurement as a screening problem: vet the carrier, check the authority, watch for the reincarnated bad actor. The pattern in CargoNet’s Labor Day data is built to walk straight through that control. Across the Labor Day periods of 2021 through 2025, CargoNet tracked 273 incidents worth $31.8 million — and the entry point it describes is not a fraudulent carrier. It is a real one whose credentials have been taken over.

The mechanism defeats point-in-time vetting by construction. FreightWaves reports criminals “enter trusted freight channels through compromised carrier accounts, email systems, business phones or compliance platforms,” and “may change delivery instructions after a legitimate trucking company takes possession.” Read that sequence carefully: the carrier you qualified is the carrier that picked up the load. Nothing in a qualification file — authority status, safety score, insurance certificate, chameleon-carrier screening — is false at the moment the theft occurs. The control you bought is answering a question the thief never asked.
The exposure is concentrated enough to plan around. Three states carry 48% of incidents (California 70, Texas 38, Illinois 22). Four weekdays carry 71% (Friday 55, Tuesday 49, Thursday 46, Wednesday 44) — with Friday alone the single worst day, which is what you would expect from a pattern that exploits the thinning of staffed hours going into a long weekend. And the commodity mix is ordinary freight, not high-value electronics as the stereotype suggests: food and beverage leads at 49 incidents, ahead of household goods (27) and electronics (25). If you move consumer goods through California or Texas on a Friday before a holiday, you are in the center of this distribution rather than the tail of it.
The incident count is not a straight line up, which matters for how you argue it internally. The yearly counts run 33 in 2021 to a peak of 70 in 2024, then 56 in 2025. That is a real elevation over the 2021 baseline and a decline off the peak — not the runaway curve a vendor deck would draw. Use the level, not a trend line: this is a persistent elevated exposure, and the honest version of that claim is the one that survives a CFO’s follow-up question.
The control that actually bites is a change-authentication rule, not another screening tool. Because the fraud is an instruction change on a live load, the countermeasure belongs in your transportation agreements and your exception process, not in your vendor onboarding checklist. Three provisions worth pricing into your next carrier and broker agreements: (1) in-transit delivery-instruction changes are only valid through a named channel and a pre-agreed callback to a number on file — never the number or address in the requesting message; (2) the carrier must notify you of any compromise of its dispatch email, phone, or compliance-portal credentials within a fixed window, as a contractual duty rather than a courtesy; (3) re-consignment and delivery-address changes above a stated load value require two-party confirmation. None of this comes from the CargoNet reporting — the reporting identifies the exposure and stops there. It is the control set the mechanism implies.

So what: pull your holiday-weekend and Friday shipment volume through California, Texas, and Illinois, and check whether a single dispatcher email account can change a delivery address on a load in transit without a second confirmation. If it can, that is the finding — and it is a contract-and-process fix, not a software purchase.

2. CBP just asked 64 questions about your suppliers’ foreign paperwork. You have until December 1 to answer.

On September 2, Customs and Border Protection opened docket USCBP-2026-1058, Heightened Import Disclosures for Supply Chain Visibility. Read the headline and it sounds like another compliance burden landing on importers. Read the document and it is something more useful than that: an advance notice of proposed rulemaking — 64 questions, no draft regulatory text, nothing required of anyone today. CBP has not decided to regulate. It is deciding whether and how, and the comment window closes December 1, 2026.

That distinction is the opportunity. Once an NPRM is written, you are commenting on someone else’s draft. Right now you are being asked what the draft should say.

The core question is whether you will have to produce paperwork you have never held. CBP is weighing whether importers of record must submit the documents the foreign exporter filed with its own customs authority — export declarations, commercial invoices, packing lists, certificates of origin, export licences, bills of lading. The stated purpose is reconciliation: compare what your supplier declared on the way out against what you declared on the way in, and the gap exposes dual-invoicing and illegal transshipment. Note where the obligation lands. You would be responsible for obtaining documents that a foreign supplier filed with a foreign government — a supplier who has no contractual duty to give them to you, and in some markets a positive interest in not doing so.
The manufacturer identification code is on the table, and CBP’s own critique of it is blunt. CBP says the MID gives “limited identifying information,” “does not always identify the actual party that may be of interest to CBP for enforcement purposes,” and can “result in the same MID for multiple entities.” It is asking what should replace it — and it names four candidates outright: D-U-N-S, GLN, LEI, and Altana ID. If a Global Business Identifier becomes an entry data element, supplier identity stops being a procurement-master housekeeping problem and becomes a customs filing field. Buyers whose supplier records are keyed on a name string rather than a durable identifier would feel that first.
CBP wants to know who the goods are actually for. Question 34 asks whether importers must identify “the party to which the merchandise is ultimately intended to be delivered, who may not be the initial recipient or the consignee taking custody of the goods upon arrival.” Today’s entry data names the consignee at the port. This would push visibility through to end use — which is the point, for diversion detection, and which is also a disclosure question for anyone whose distribution arrangements are commercially sensitive.
The absence of a cost estimate is the reason to comment, not a reason to wait. The ANPRM contains no burden estimate and no figure for how many importers are affected. CBP explicitly asks commenters to provide costs and benefits “with sufficient information to recreate those calculations,” with particular attention to small businesses and critical goods. The record gets built out of whatever industry submits. An importer who can show, with real numbers, that its Tier-2 suppliers cannot produce a foreign export declaration inside a 30-day entry cycle is putting the only evidence on the record that exists on that point.

So what — and this part is worth doing whether or not this rule ever lands: pick your five largest import suppliers and ask a single question — can you give me a copy of the export declaration you filed with your own customs authority for our last shipment? You are not preparing for a requirement; there isn’t one. You are running a diligence test. A supplier who produces it in a week is telling you their filings reconcile. A supplier who cannot, or will not, has told you something about your exposure that no screening tool was going to surface — and you have learned it at a moment when the answer costs you nothing but an email. If the answers are bad, that is your comment to CBP, filed at regulations.gov under docket USCBP-2026-1058 before December 1.

3. The portal your carriers log into is being impersonated — and so is the step you use to check them

Item 1 named four ways a thief gets inside a legitimate carrier: its accounts, its email, its phones, or its compliance platforms. The fourth one now has a name. FMCSA has posted a fraud alert: “Latest reports indicate that bad actors have started to impersonate the Motus … website application.” Motus is the system FMCSA moved motor carrier, broker and freight forwarder registration onto this year — the source of the operating-authority and insurance-filing records your carrier-qualification process reads.

The bait is routine paperwork. FMCSA says recipients are getting emails with the subject line “Notice of Required Off-Cycle Update- Motus email”, urging them to click a “New MOTUS Portal” link and update their profile. FMCSA lists four bogus addresses behind that portal: dot.motusdatasboard[.]com, dot.motusdatadesk[.]com, dot.motuswebdeck[.]com and dot.motusfunction[.]com. The only legitimate address is motus.dot.gov. After months of real Motus rollout problems, an “update required” email is exactly what a busy dispatcher expects to get.
What it opens up is the carrier’s record, not just its inbox. A stolen Motus login belongs to a carrier that has passed every screen you run. FMCSA’s alert does not report any cargo loss tied to this campaign, and we are not claiming one. But the mechanism is the one from Item 1: the counterparty is real, and the channel you trust to learn about it has been compromised.
Your own team’s verify step is exposed too. When a carrier’s status looks wrong, the right move is to check Motus or SAFER. That is also exactly what a fake “Motus” email invites someone to do. A procurement or logistics analyst who follows a link to “confirm the carrier’s updated insurance” has handed the verify step to whoever sent the link.

So what: three changes, none of which need a purchase. (1) Write it into your carrier-status process that Motus and SAFER are reached by typing motus.dot.gov or safer.fmcsa.dot.gov, never through a link in an email, including one that appears to come from the carrier. (2) Treat a carrier contact, remit-to or insurance change that arrives “after a Motus update” as an instruction change under Item 1’s rule: callback to the number already on file before anything changes. (3) In the credential-compromise notice duty from Item 1, name compliance-portal logins (Motus included) alongside dispatch email and phones, so a carrier that gets phished has to tell you.