Cargo theft in 2026 is getting rarer and far more expensive, because criminals stopped stealing trucks and started stealing identities. Verisk CargoNet logged 677 incidents in Q2 2026 — down 26% year over year — while losses more than doubled to $304.6 million, up from $135.7 million a year earlier.

Fewer thefts. Bigger hits. That inversion tells you exactly what changed: the people taking freight now target the paperwork, not the padlock.

What the Q2 2026 numbers actually show

Cargo theft in Q2 2026 became less frequent and far more costly: 677 incidents, down 26% year over year, producing $304.6 million in losses versus $135.7 million in Q2 2025. The full-year picture sets the trend line. U.S. and Canada cargo-theft losses hit a record of roughly $725 million in 2025, a 60% jump from about $455 million in 2024, with the average theft topping $273,990 — up 36% in a single year.

Then the mechanism shifted. The National Insurance Crime Bureau reported deceptive pickup schemes up 31% in Q1 2026. Strategic theft — where the freight is handed over voluntarily to someone impersonating a legitimate carrier — now accounts for roughly one third of all incidents. Industry estimates put annual losses from these organized schemes somewhere between $3.5 billion and $10 billion.

Most telling: in the U.S., nearly a third of all incidents involved criminals who never touched a vehicle, never forced a lock, and never triggered a physical alert.

Why is strategic theft so hard to catch?

Strategic cargo theft is hard to catch because it doesn't look like theft — the freight is handed over voluntarily, through channels that look routine, to someone carrying credentials that check out.

In April 2026 the FBI's Internet Crime Complaint Center issued a public service announcement on cyber-enabled strategic cargo theft. The pattern it describes is unglamorous and effective: threat actors gain unauthorized access to broker and carrier systems through spoofed emails and compromised accounts, then post fraudulent listings on load boards to redirect shipments for theft and resale.

The toolkit has expanded accordingly — AI-assisted impersonation, digital identity theft, fictitious carrier creation, MC number cloning, and double brokering. Globally, about one in five thefts involves someone already inside the organization supplying the intelligence that makes a high-value, targeted hit possible.

None of that is stopped by a yard gate. Every one of those attacks arrives as a message that looks legitimate, to a person who is busy.

The gap is between onboarding and dispatch

Most brokerages vet carriers thoroughly at onboarding and never again. Authority check, insurance certificate, references, maybe a fraud-database screen — all performed once, then left to go stale while the carrier relationship continues for months.

The attack happens later, in the gap:

• Carrier setup — Where verification usually happens: Authority and insurance checked once at onboarding · Where the attack actually lands: The email changing pickup details day-of
• Ongoing relationship — Where verification usually happens: Annual insurance re-check · Where the attack actually lands: A phone number that doesn't match the file
• Load award — Where verification usually happens: Load board profile checked at listing · Where the attack actually lands: A rate con returned from a lookalike domain
• Payment — Where verification usually happens: Credit review at setup · Where the attack actually lands: An "updated" remit-to on the invoice

The exploit is not a missing policy. It's a policy that gets skipped under time pressure. At 4pm on a Friday with a load that has to move, the dispatcher who re-verifies a changed phone number against the carrier file is the exception, not the rule — and the people running these schemes know exactly when to send the message.

What consistent verification looks like

Consistent carrier verification means running the same identity checks on every inbound message that changes load details — not once at onboarding. The fix is not a smarter human; it is making the check unskippable and identical every time:

• Re-verify on change, not on schedule. Any inbound message that alters pickup location, contact number, remit-to details, or equipment should trigger the same verification steps regardless of who sent it or how urgent it sounds.
• Match the channel to the record. A dispatch update from a domain, number, or account that doesn't match the carrier file is an exception — not a formatting quirk to work around.
• Never let urgency shorten the sequence. Time pressure is the attack surface. A process that runs the same at 4pm Friday as it does at 10am Tuesday removes the opening.
• Log everything. When freight goes missing, the reconstruction — what was sent, from where, what was verified, who approved the change — is the difference between a recoverable claim and a write-off.

This is exactly the kind of work that suits automation, because it's high-volume, rule-shaped, and degraded by human fatigue. An AI agent reading inbound email, chat, SMS, and WhatsApp applies the same verification sequence to the 400th message of the day as it did to the first, cross-checks details against the carrier record in your TMS, escalates anything that doesn't reconcile to a human, and writes an audit trail as a by-product of doing the work.

Automation doesn't make the judgment call about whether a carrier is fraudulent. It makes sure the check that surfaces the discrepancy actually runs, every single time.

What should you re-verify, and when?

Re-verification should be triggered by change, not by calendar. Any inbound message that alters one of these fields warrants running the full check again, regardless of which carrier it appears to come from:

• Pickup location or appointment — Why it matters: The single most common deceptive-pickup vector
• Driver or dispatch phone number — Why it matters: Redirects the conversation off your verified channel
• Remit-to or banking details — Why it matters: Converts a delivered load into a payment loss
• Equipment or trailer number — Why it matters: Signals the load may have been re-brokered
• Email domain or reply-to address — Why it matters: Lookalike domains are the entry point for account compromise

The check itself is unglamorous: does the sender's channel match the carrier record, does the authority remain active, and does anything about this request depend on being handled before someone can confirm it? Urgency attached to a detail change is the single strongest fraud signal in freight, and it is the one humans are most likely to override.

The bottom line

The Q2 2026 data is not a story about more crime. It's a story about better-targeted crime: 26% fewer incidents extracting more than double the losses, with a third of it executed entirely through documents and messages.

If a third of cargo theft now arrives in the inbox, that's where verification has to live. Vetting a carrier once at onboarding defends a perimeter the thieves stopped attacking.

Debales deploys AI agents that handle freight communications across email, chat, SMS, and WhatsApp — applying consistent verification steps to every message, reconciling details against your TMS, and logging a complete audit trail. [Book a demo](https://debales.ai/book-demo).