- Trans.eu recorded more fraud attempts in 2026 than in the previous year, although the estimated value of cargo stolen in cases known to the platform was lower.
- Criminals use phishing, lookalike domains and hijacked accounts to impersonate reputable carriers.
- Checking a company’s documents and operating history does not confirm that the person making contact is authorised to act on its behalf.
- Fraudulent companies can also carry out legitimate shipments at first, using them to build trust before committing fraud.
The webinar, titled ‘Cargo security and transport fraud during the fourth-quarter peak season’, brought together Piotr Sobala, area leader for product security at Trans.eu; Małgorzata Łazowska, managing partner at SSC Poland; Elena Lădariu, manager of Rocktrans Spedition; and Agnieszka Wojnowska, a security expert at XBS Logistics. The discussion was moderated by Michał Pakulniewicz, a transport market analyst at the European Institute of Road Transport.
A central theme was the growing number of ways criminals impersonate legitimate carriers, along with the difficulty of detecting fraud before a shipment changes hands.
More fraud attempts, but lower losses per incident
Piotr Sobala, area leader for product security at Trans.eu, said the changing tactics used by criminals were reflected in the incidents recorded by the platform.
According to the figures he presented, the number of attempted fraud cases was higher in 2026 than in 2025. At the same time, the estimated value of stolen cargo in cases known to Trans.eu was significantly lower than before. That does not necessarily mean the transport market is becoming safer. Rather, it suggests that the nature of the threats is changing.
Several years ago, one of the most worrying scenarios involved taking over an established transport business. Criminals could acquire a legally operating company with a long track record and a solid reputation, then use that credibility to obtain cargo fraudulently.
Today, Sobala noted, criminals are increasingly choosing faster methods that do not require them to take control of an entire business.
Taking over an account is quicker and cheaper, and criminals only need to use it for a short time. That window of opportunity may last just a few hours, the expert explained.
During that brief period, a fraudster can exploit the genuine company’s reputation, review available loads and attempt to take over a shipment before the authorised user notices the unauthorised access.
According to Sobala, the threat is no longer limited to companies handling particularly valuable goods.
Today, virtually any company can become a target for identity impersonation, he said.
The growing number of short-lived attacks also means that a wider range of transport market participants may be targeted.
One altered letter in an email address can create false confidence
Elena Lădariu of Rocktrans Spedition described how difficult it can be to spot a scam attempt in the day-to-day work of a freight forwarder. She recalled an incident her company had encountered roughly two months earlier. Employees received an email from an address that differed from the legitimate address by just one letter.
The tactic is simple: the message appears to come from a familiar business partner, while the minor change in the domain can easily go unnoticed, especially when teams are handling a heavy flow of shipments.
Lădariu said her company compares contact details with the information stored on the freight platform it uses.
If a specific email address is listed on the platform, we copy that exact address. We only call the telephone number recorded there, she explained.
Piotr Sobala confirmed that email impersonation remains a serious problem.
In his estimate, the vast majority of such cases recorded since the beginning of 2025 involved attempts made outside the freight platform, mainly through email communication.
This distinction matters from a security perspective. Even when a company has already been verified on a freight exchange, moving the conversation away from the platform can make it harder to detect someone posing as that business partner.
The account is genuine. The question is who is using it
An even harder scenario to identify arises when criminals do not create a fake contact address but gain access to a real user account. Sobala recalled cases in which fraudsters created websites imitating Trans.eu. The web addresses differed from the genuine site only in minor details, with the aim of collecting users’ login credentials.
Stolen credentials do not always need to be used immediately. Criminals may wait for the right opportunity to access an account belonging to a legitimate business. In other cases, they may try to add a new user to the company account without the owner’s knowledge.
For a freight forwarder, this is particularly dangerous because a routine check of the counterparty may reveal nothing suspicious.
The company itself exists. Its documents are genuine. Its business history and previous cooperation may also be authentic.
The only unauthorised element may be the person using the account or claiming to represent the business at that moment.
That is why checking registration details, licences and insurance alone cannot address every security risk connected with a transport transaction.
A company may carry out genuine shipments before disappearing with the cargo
Hijacked accounts are not the only way criminals exploit established trust. The panel also examined the role of so-called shell companies — businesses created with the intention of using them to commit fraud.
Such a company may be legally registered and hold the required documents, licences and insurance. It may also pass standard verification procedures.
It can even begin by conducting genuine transport operations.
A company may complete legitimate orders for several weeks or months and build a trustworthy track record. Then, one day, it simply disappears, Sobala said.
Those earlier shipments give the business a positive cooperation history. From a potential customer’s perspective, it may look no different from many other carriers operating in the market.
Sobala said this type of fraud may involve one, two or several transactions. It does not always require a large-scale operation targeting dozens of companies.
The difficulty is that even a properly conducted formal verification cannot conclusively reveal the true intentions of a company’s owners.
Fake delivery instructions and substitute carriers
Małgorzata Łazowska of SSC Poland pointed out that identity-related fraud can have immediate consequences for the physical supply chain.
She said that, in conversations with transport companies, she had repeatedly encountered cases in which businesses received messages or calls from people posing as customers and instructing them to change the delivery location.
Another scenario involved a fake carrier arriving for loading while claiming to represent the company that had actually been assigned the shipment.
In both situations, the credibility of the information provided by the person contacting the carrier, freight forwarder or warehouse was critical.
Criminals do not always need to break into a truck. Sometimes they only need information or access to our data, Łazowska stressed.
She also noted that traditional threats have not disappeared. Trailers are still broken into, curtains are cut, criminals still try to gain access to vehicles and drivers are attacked.
Transport companies therefore need to address both the physical security of vehicles and cargo and the risks linked to communication and access to information.
How can you confirm who is really on the other side?
The discussion highlighted a key limitation of traditional verification procedures.
Checking a carrier’s licence, insurance policy, registration details and operating history remains an important part of assessing a business partner. However, it does not answer the crucial question of whether the person accepting the order or issuing instructions actually represents that company. This becomes especially important when a decision has to be made quickly — for example, when a carrier is needed at short notice, a delivery address changes or someone suddenly contacts the business claiming to work for a familiar company.
One practical recommendation from the webinar was to confirm a partner’s contact details independently rather than relying solely on the information contained in an incoming message.
It is equally important to watch for unexpected changes in communication methods, email addresses, telephone numbers or instructions concerning the release and delivery of goods.
The cases discussed by the experts show that a company’s credibility and the credibility of the person acting on its behalf are two separate questions. For businesses entrusting goods to a carrier, this means checking not only which company has formally been assigned the transport but also who is actually accepting the order and issuing instructions about the shipment.
