CargoNet Warns: Transport Fraud Is Evolving, Not Disappearing

New data shows fewer cargo theft incidents but dramatically higher losses as criminals exploit trusted transportation systems

Cargo theft may be declining in raw numbers, but the criminals behind some of the most sophisticated schemes appear to be getting better at choosing their targets and manipulating the systems used to move them.

In its 2026 Second Quarter Supply Chain Risk Trends Analysis, Verisk CargoNet reported 677 supply-chain theft incidents across the United States and Canada, down 26% from the second quarter of 2025.

The losses tell a very different story.

Estimated losses reached $304.6 million, more than double the $135.7 million reported during the same quarter last year. Among incidents where a commodity value was reported, the average loss reached $564,009, although CargoNet cautioned that several multimillion-dollar thefts pushed that average higher.

For the repossession industry, however, what may matter most isn’t how much was stolen.

It’s how some of it is being stolen.

The Criminal May Be Inside the Trusted Channel

CargoNet reports that traditional physical theft and certain non-delivery schemes declined during the quarter, while business-email compromise and shipment-misdirection schemes remained comparatively stable.

Business-email compromise has become a particularly dangerous entry point.

According to CargoNet, a compromised account can give criminals access to shipment information, contacts, communications and transportation-management systems. From there, criminals may impersonate trusted parties or change shipment details while appearing legitimate to the broker, shipper, carrier or receiver.

CargoNet reinforced that warning in its more recent September 4 Labor Day Cargo Theft Analysis.

The organization warned that criminals are compromising carrier accounts, business phone systems, email accounts and compliance-platform credentials, allowing them to operate through communication channels normally considered trustworthy.

Most significantly, CargoNet says the theft can occur after a legitimate carrier has already taken possession.

A criminal who gains access to the transaction can change a delivery address or contact after pickup, potentially bypassing security controls that concentrated on verifying the carrier before the shipment was released.

That’s an important distinction for anyone releasing recovered collateral.

The truck can be legitimate.

The driver can be legitimate.

The carrier can be legitimate.

The destination may not be.

Why This Should Sound Familiar to Repossession Agencies

CURepossession readers have been watching this threat develop for some time.

In ARA Alert – Transporter Fraud, recovery agencies were warned about fraudulent vehicle pickups and the danger of apparently legitimate transport documentation.

Auto Transport Theft Scheme Exposed went deeper into the mechanics of the fraud, including situations in which legitimate transporters could unknowingly become participants in the theft.

By May, Transport Fraud Pressure Begins Shifting Toward Repossession Agencies examined how increasingly stringent transporter-verification requirements were beginning to place more responsibility at the recovery agency’s gate.

Most recently, The Yerevan Connection: Following the Transport Fraud Trail to Repossession Lots followed the threat much farther upstream.

That investigation examined the July raid in Yerevan, Armenia, involving the alleged Diesel Vortex cybercrime operation and its targeting of transportation-related systems, including Central Dispatch. As CURepossession emphasized at the time, no evidence established that the organization stole a specific repossessed vehicle or was responsible for previously reported transporter thefts.

But the case demonstrated something much larger: the digital identity behind a legitimate transportation transaction can itself become the target.

An Arrest Doesn’t End the Fraud

The Yerevan arrests might have taken one alleged operation off the board. But stopping fraud is like playing “Whack-a-Mole”, you knock one down and up pops another. CargoNet’s newest findings are a reminder that the underlying method is very much alive.

This isn’t one Armenian operation, one fraudulent transporter or one compromised dispatch account. CargoNet is describing organized criminals attacking the trust infrastructure used throughout transportation—email accounts, telephone systems, carrier credentials, compliance platforms and shipment information.

That has particular implications for repossession agencies because they often represent the last controlled physical checkpoint before recovered collateral reenters the transportation system.

Verifying that a carrier exists remains important. So does checking the driver, equipment, insurance and DOT information.

But CargoNet’s findings reinforce the distinction CURepossession raised in the Yerevan investigation: carrier verification and transaction authentication are no longer necessarily the same thing.

If legitimate credentials have been compromised, confirming that the carrier is legitimate may simply confirm the legitimacy of the company whose identity is being abused.

The more important question at the gate may increasingly be whether this driver, with this equipment, under this dispatch, is authorized to pick up this VIN and deliver it to this destination right now.

CargoNet’s numbers may be about the broader freight industry, not repossessions specifically. But the fraud method translates remarkably well to recovered vehicles.

And despite arrests, warnings and improved verification procedures, the newest CargoNet data makes one thing clear:

Transport fraud is far from over.