Freight Fraud Shifts from the Parking Lot to the Inbox as Logistics AI Funding Accelerates

The Analysis

The channel changed and the controls did not. Industry analysis published 30 July 2026 describes cargo crime moving off the parking lot and into the inbox: email identity spoofing, double brokering and fake carrier onboarding, all conducted online with no physical proximity to the freight. The cases behind the shift are large. A Texas man was extradited over a five-year conspiracy valued at roughly one billion dollars in stolen cargo, and a counterfeit postage scheme cost the US Postal Service about 150 million dollars in revenue. Two logistics AI companies announced a combined 87 million dollars in new funding the same day, one aimed at fraud screening and one at back-office automation.

Read as a market signal, that looks like an industry responding. Read as a system, the response is aimed at the wrong stage of the process.

Fraud is an optimisation problem run by an adversary. The adversary moves to the channel where the cost of a failed attempt is lowest and the cost of an attempt is near zero. That is what email is.

Physical theft has a floor under its marginal cost. You need a yard, a tractor, a driver willing to take the load, somewhere to fence the goods, and a story for the missing trailer. Each step leaves a record and requires a person. Email fraud has no such floor. A domain costs less than a tank of diesel. A phone number costs nothing. The attacker can run fifty attempts and only needs one carrier to onboard, one broker to accept a rate confirmation, one accounts payable clerk to update a bank detail. The economics of the attack changed by orders of magnitude, and the defence is still mostly a person looking at a form.

So the migration is not a story about criminals becoming more sophisticated. It is a story about a control surface designed for a world where the attacker had to show up. Verification used to be implicit in proximity: the man at the gate was the carrier, because he was physically there with the tractor. Remove the gate and verification has to be rebuilt as an explicit step, and most operations never rebuilt it. They replaced a physical check with an email.

The scale is worth converting to annual terms, because annual numbers change how a budget feels. One billion dollars over five years averages two hundred million a year from that single conspiracy. The 87 million dollars announced in one day is about 43 percent of one year of that one scheme's damage. The 150 million in counterfeit postage, measured as lost revenue at USPS, is larger than the entire daily funding round. None of this says the funded companies are solving the wrong problem. It says capital is not the binding constraint. Placement is.

Watch where the irreversible event happens. Cargo theft is discovered when the trailer is opened and found empty, which is late but salvageable, because the goods exist somewhere and the claim is a cargo claim. Double brokering is discovered when the real carrier calls about an unpaid invoice, or the consignee calls about a load that never arrived. A bank detail change is discovered when the money is gone, which takes one banking cycle and is usually not reversible at all. Three failure modes, three clocks, and the shortest clock is attached to the least glamorous control.

This is where the detection-model instinct meets arithmetic. Take a worked example with my own assumptions: one booking in a hundred is fraudulent. A screening model with 99 percent sensitivity and 99 percent specificity sounds like a solution. Run a thousand bookings through it. Ten are fraudulent, the model catches about ten, maybe missing one. Nine hundred ninety are clean, and the model flags about ten of those as well. Twenty flags, roughly ten correct. Half the carriers you block are legitimate.

Drop the prevalence to one in a thousand, which is closer to reality for a well-run broker, and the same model produces about eleven flags to catch one fraud. Nine in ten blocks are good carriers. The model did not get worse. The base rate moved. That is not a criticism of anyone's algorithm, it is a property of screening rare events, and it explains why fraud scores in this industry end up either loose enough to be decorative or tight enough to strangle capacity.

The conclusion is not that models are useless. It is that a probability cannot be the gate. Deterministic checks belong at the gate: verify the operating authority against the registry, call back to the number you already hold rather than the number in the email, require dual approval plus an out-of-band confirmation for any change to bank details, and treat a new carrier's first load as a supervised transaction. Models belong in triage, ranking the queue for humans, where a false positive costs a phone call instead of a truck.

Any threshold is learnable. An attacker who submits variations and watches which ones get rejected is running an experiment, and the experiment converges. Static rules have a half-life measured in weeks to months, so the honest metric for a fraud control is not its catch rate on last year's data, it is how long the rule stays effective after it appears in a process document. Controls that depend on the attacker not knowing the rule decay quickly. Controls that depend on the attacker not being able to produce something expensive do not decay, because the cost is structural. A callback to a number you already hold is expensive to defeat. A form field asking for an MC number is free to fill in with any number.

Double brokering is a trust-chain problem rather than an identity problem. The broker vets the carrier, the carrier subcontracts to another carrier, and the shipper sees step one and nothing of step two. Every handoff is a place where the verified identity stops being the operating identity. The number of handoffs is the exposure, and most shippers cannot count their own.

Follow the loss. The shipper signs a rate confirmation with a broker, the broker pays a carrier that turns out to be a front, the front disappears, and the carrier that actually moved the load was never paid. The cargo owner may pay twice, or lose the goods, or both. Where the loss lands depends on who signed the release and what the contract says about subcontracting. The party with the weakest verification eats it, and that party usually has the least leverage to insist on verification: the small shipper with one lane, or the small carrier at the bottom of the chain whose identity was borrowed. Large shippers have vendor master controls, dual approval and a security team, and enough volume to make a carrier accept a stricter onboarding. The asymmetry compounds.

For a carrier, fake onboarding is a different injury. Somebody is operating under your authority, generating claims and safety scores against your record, and you find out at insurance renewal. For an exporter, the exposure sits in the release instruction, because that is the message telling the forwarder to hand over the goods.

The clock here is short. A payment instruction change executes inside one banking cycle, sometimes within hours. That means the only useful control is the one that runs before the instruction executes, and a weekly reconciliation is not a control, it is a post-mortem with better formatting. What you will actually notice first is not a loss. It is a message asking to update bank details, or a rate confirmation from an address one character off. That message is the entire warning system, and it arrives when nobody senior is awake.

What the coverage does not say is that the move to email changed the unit of loss and the point of detection, and the spending has not followed. Physical theft is a cargo loss discovered after the fact and handled as an insurance claim. Email fraud is a payment loss discovered at the moment of transfer and often not covered at all, because the shipper authorised the release. That shifts the risk from an insurable event to an uninsurable one, which changes the correct control from buying cover to preventing the instruction.

The second thing missing is a market signal pointing the wrong way. The 87 million went to fraud screening and back-office automation, which is detection and cost reduction. The irreversible node is the payment instruction, and payment controls are cheap, boring and impossible to fund as a category. Capital follows the interesting problem, not the binding one. If you are buying, buy the boring one first.

What would reverse this conclusion? A shared carrier identity registry with signed credentials collapses the cost of verification per transaction and improves the base rate at the same time, because a verified identity is not a probability. Until that exists, more model accuracy mostly moves false positives around the queue. If your broker already enforces out-of-band confirmation on bank changes, your residual exposure sits at the first load from a new carrier, and that is where the effort belongs rather than in a scoring dashboard.

The trap is documenting a fraud score in the procedure and calling it a control. An auditor will eventually ask what happens when the score is 62, and there will be no answer, because the score was never a decision rule. A control has a threshold, an owner and a record. A score has a number.

↑ Back to the key points

— By Ravi Chandran