Most load hijacking does not happen at booking. It happens in the hours after booking, when a "dispatcher" emails to say the driver changed, the truck number is different, and here is a new phone number for pickup. That message is routine enough that a busy rep updates the load and moves on. It is also the exact moment a criminal takes the freight.

The numbers show fraud replacing force. Verisk CargoNet recorded 677 supply chain theft incidents in Q2 2026, down 26% year over year — but losses more than doubled to $304.6 million. In Q1 2026, CargoNet logged 767 events and $131.58 million in losses. Fewer thefts, much larger losses per theft.

The method has shifted too. Nearly a third of US incidents involved criminals exploiting digital freight platforms, forged identities and insider information. The FBI's Internet Crime Complaint Center issued a 2026 public service announcement on cyber-enabled strategic cargo theft (FBI IC3). Thieves are not breaking into trailers. They are booking the load, or hijacking a legitimate booking, through email and phone.

Where does the vulnerable moment actually sit?

Most fraud controls concentrate at carrier onboarding and load booking: check the MC number, verify insurance, confirm authority. Those controls matter, and our guide to carrier identity verification against cargo theft covers them.

But booking verification checks the carrier at one point in time. A hijacking exploits what happens next:

• The carrier was legitimate, but a criminal impersonates its dispatcher from a lookalike email domain.
• The booked carrier re-brokers the load without permission — the pattern behind double brokering.
• A "driver change" arrives with a new name and phone number the night before pickup.
• The truck and trailer numbers submitted at check-in do not match what was confirmed.
• Pickup instructions are changed to redirect the load to a different location after loading.

Each of these looks like normal operational noise. Carriers do swap drivers. Trucks do break down. That is why the change gets accepted without a second look.

Why do reps accept the change?

Because the change request is designed to look routine, and it usually arrives under time pressure. A pickup is in three hours, the shipper is waiting, and the email is polite and specific. Stopping to verify feels like creating a delay.

Three patterns make it worse:

No baseline to compare against. If the booked driver, truck and dispatcher contact were never captured in a structured record, there is nothing to check the change against.

Changes arrive on a different channel. The booking was confirmed by phone, the change arrives by email, and the rep has no easy way to see that the sender domain is one letter off.

Verification is manual and optional. When calling the carrier back on a known number depends on someone remembering, it happens inconsistently — and consistency is the whole point.

Should driver and truck changes be verified automatically?

Yes. Any mid-load change to driver name, truck or trailer number, driver phone, dispatcher contact or pickup and delivery instructions should be automatically flagged against the booked carrier record and held until verified through a known contact — because these changes are the primary mechanism for load hijacking, and manual checks fail under time pressure. Automation makes verification the default rather than a judgement call.

A practical verification flow:

1. Capture a baseline at booking. Carrier MC and DOT, dispatcher email and phone, driver name and phone, truck and trailer numbers — stored in the TMS load record.
2. Detect changes across every channel. An agent reads inbound emails, texts and call notes, and extracts any change to the baseline fields.
3. Check the source. It compares the sender's domain and phone number with the carrier's verified contacts and flags lookalike domains or new numbers.
4. Hold and verify. It places the load on hold for release and contacts the carrier through the contact on file — not the one in the change request — to confirm.
5. Escalate with context. If verification fails or the carrier cannot be reached, it routes the load to a person with the full timeline of the change.

What should trigger a hold?

Not every change is fraud, and a good process separates low-risk updates from high-risk ones:

• Updated ETA from known dispatcher — Risk level: Low · Suggested action: Update record, notify shipper
• New driver name, same carrier contact — Risk level: Medium · Suggested action: Confirm via contact on file
• New dispatcher email or phone — Risk level: High · Suggested action: Hold, verify via known number
• Lookalike or new sender domain — Risk level: High · Suggested action: Hold, escalate to a person
• Changed delivery address after pickup — Risk level: Critical · Suggested action: Hold, contact shipper and carrier
• Truck or trailer mismatch at check-in — Risk level: High · Suggested action: Do not release until verified

The shipper's dock plays a role too. If the pickup facility receives the confirmed truck, trailer and driver details ahead of time, a mismatch at check-in becomes visible before the freight is loaded.

Can the agent itself be targeted?

Yes, and it should be designed with that in mind. Fraudsters who know a brokerage uses automation may craft emails intended to manipulate the system — instructions hidden in the body telling it to update a contact or release a load. An agent that processes freight email must treat message content as data, not as commands, and must never let an inbound email change a verified contact on its own. We covered this in detail in our piece on prompt injection and freight email agent security.

The principle is the same one that stops human-targeted fraud: verified contact data changes only through a verified channel.

Frequently asked questions

What is load hijacking? Load hijacking is cargo theft in which criminals take control of a legitimate shipment, typically by impersonating the booked carrier or its dispatcher, changing driver or truck details, or redirecting pickup and delivery instructions.

How much did cargo theft cost in 2026? Verisk CargoNet reported $131.58 million in losses across 767 events in Q1 2026, and $304.6 million across 677 incidents in Q2 2026. Incident counts fell while losses per incident rose sharply.

Are driver swaps always suspicious? No. Carriers legitimately change drivers and equipment. The risk is accepting the change without confirming it through the carrier's known contact, especially when it arrives from a new email address or phone number.

Can AI agents stop cargo theft? Agents cannot prevent every theft, but they can make verification consistent — flagging every mid-load change, checking sender identity against verified contacts, and holding release until confirmation arrives.

The bottom line

Cargo theft in 2026 is fewer incidents with much larger losses, and nearly a third of US cases involve digital fraud rather than force. The weakest point is not booking — it is the driver, truck or dispatcher change that arrives afterward.

Capture a structured baseline at booking, detect every mid-load change across every channel, verify through contacts on file rather than contacts in the request, and hold release until the change is confirmed.

Debales deploys AI agents for carrier communication and load verification — flagging mid-load driver, truck and contact changes and holding release until they are confirmed. Book a demo.