Freight fraud has moved into the inbox. In Q2 2026, 784,201 fraudulent freight emails were blocked, up 48.5% from the previous quarter (carrier-identity industry data, Q2 2026). Earlier in the year, roughly half of thefts involved carriers with legitimate MC numbers (carrier-identity industry data, Q1 2026). Identity checks at onboarding are necessary, but they cannot catch a lookalike domain or a "new dispatcher email" that arrives in the middle of a load. The carrier passed vetting. The email that redirects the load or the payment did not come from that carrier.

That changes where brokers need controls. Onboarding verifies who a carrier is once. Email arrives all day, on every load, and any message can be the one that is not real.

Why aren't onboarding checks enough anymore?

Because the fraud is not happening at registration. It happens after a legitimate carrier is set up, through messages that look like they come from that carrier.

If about half of thefts involve carriers with real, valid MC numbers, the authority check passed in each of those cases. Something else went wrong later: a message that impersonated the carrier, a compromised email account, or a contact change that nobody verified. We covered the onboarding side, including authority, insurance and identity, in our post on real-world AI carrier vetting for freight fraud prevention. That work still matters. It just does not cover the inbox.

What do inbox-based fraud attempts look like?

The patterns are familiar to anyone who has worked a brokerage inbox:

• Lookalike domain — What arrives: Email from a domain one character off the carrier's real one · What it is trying to do: Get the load, rate con or pickup details
• New dispatcher contact — What arrives: "Please send all future loads to our new dispatch email" · What it is trying to do: Redirect communication to an attacker
• Payment change — What arrives: "We've switched factoring companies, here are new bank details" · What it is trying to do: Redirect payment
• Spoofed reply in a real thread — What arrives: A reply that looks like it continues a legitimate conversation · What it is trying to do: Insert new instructions mid-load
• Urgent release change — What arrives: "Please release the freight to this name instead" · What it is trying to do: Get the freight released to the wrong party

Each message is ordinary on its own. Contact changes and factoring changes happen legitimately every day. That is what makes them useful to fraudsters and hard to police manually when a rep handles hundreds of emails.

Which signals should trigger verification?

The useful rule is simple: any change to who you talk to, where freight goes or where money goes gets verified outside the email channel it arrived in.

Specific signals worth checking on every inbound carrier message:

• Sender domain does not match the carrier profile. Compare the domain to what is on file, not to what looks right.
• Lookalike characters. Swapped letters, extra hyphens, different top-level domains, or a free email provider replacing a company domain.
• Reply-to address differs from the sender. A common way to divert replies.
• New contact name or email for an existing carrier, especially mid-load.
• Any change to remit-to, bank or factoring details.
• Pressure and urgency around releasing freight or changing payment.

When one of those signals appears, the next step is out-of-band verification: call the carrier at the phone number already on file, not the number in the email, and confirm the change with someone you know.

How do AI agents check every message without slowing reps down?

The challenge is volume. No rep can inspect headers on every email. An agent can, on every message, before a person acts on it:

• Matches sender domains against the carrier profile and flags mismatches, lookalike domains and reply-to differences.
• Detects change requests for contacts, equipment, pickup release names or payment details, and classifies them by risk.
• Holds high-risk changes so they cannot be applied to the load or the payee record until verified.
• Starts out-of-band verification by contacting the carrier on the phone number or contact already on file, and records the confirmation.
• Logs the audit trail of who requested the change, how it was verified and who approved it.

Routine messages, such as a POD or an ETA update from a known sender, flow through as normal. Only the messages that try to change something important are stopped. We described the broader approach in our guide to AI freight broker fraud prevention.

What about payment fraud specifically?

Payment redirection is where an email fraud attempt turns into a direct loss. A fraudulent factoring or bank change can sit quietly until the next payment run, then send money to the wrong account. The carrier calls asking where their payment is, and the broker discovers the fraud weeks later.

The defense is to treat payee changes as a separate, controlled workflow: no change from email alone, verification through a known contact, and a second approval before the payment file changes. The same discipline applies to fuel advances and other quick payments, which fraudsters target because they move fast. Our post on AI trucking fraud prevention and fuel advance scams covers that pattern.

What policy should brokers put in place now?

1. Write the rule down. Contact, release and payment changes are verified out of band, every time, no exceptions for urgency.
2. Lock the carrier profile. Approved domains, phone numbers and contacts are recorded at onboarding and only changed through verification.
3. Separate payee changes into their own approval flow with a second reviewer.
4. Check every inbound message, not just the ones a rep finds suspicious. Inspection only works if it is automatic.
5. Train reps on the patterns, and give them a fast, no-blame way to escalate a message that feels wrong.
6. Review incidents and near misses monthly to update the rules.

Frequently asked questions

How much has email fraud in freight increased?

In Q2 2026, 784,201 fraudulent emails were blocked, up 48.5% quarter over quarter (carrier-identity industry data, Q2 2026).

Do legitimate MC numbers protect against fraud?

No. Roughly half of thefts in early 2026 involved carriers with legitimate MC numbers (carrier-identity industry data, Q1 2026). Valid authority confirms who the carrier is, not who sent a given email.

What is out-of-band verification?

Confirming a request through a different channel than the one it arrived in, such as calling the phone number already on file for the carrier, rather than replying to the email or calling a number in it.

Can AI detect lookalike carrier email domains?

Yes. An agent can compare every sender domain against the approved domains on the carrier profile, flag near matches and reply-to mismatches, and hold change requests until they are verified.

The bottom line

Fraud now arrives as ordinary-looking email from carriers who already passed vetting. Check every inbound sender against the carrier profile, treat any change to contacts, freight release or payment as high risk, and verify it through a contact already on file before anything changes.

Debales deploys AI agents for inbound email screening, carrier contact and payment change verification, and fraud audit trails. Book a demo.