Freight Payment Fraud
How Fake NOAs, ACH Changes and Look-Alike Emails Redirect Carrier Pay
By Michael Thomas, Founder, Logistical Forwarding Solutions
Freight payment fraud doesn't steal the truck. It steals the money after the load delivers. A fake notice of assignment, an ACH change request or a reply from a look-alike email domain sends a carrier's pay somewhere else. It's business email compromise in trucking, and dispatchers are right in the middle of it. Here's how it works, how to verify a payment change, and how LFS Shield checks it.
Why dispatchers are the ones they impersonate
Dispatchers aren't targeted because they're careless. They're targeted because they're the one person who sees every email in the deal: the broker, the carrier, the factor and the driver. That makes the dispatcher's name the most useful one to copy.
A fraud-prevention firm's Q3 2025 index found email takeovers and phishing are primary entry points. Fraud rings blend into legitimate threads to intercept rate cons, impersonate dispatchers and redirect payments. It recommends multi-factor login and verifying any contact change through a trusted source (Q3 2025 index).
And it isn't slowing down. In Q2 2026, while other theft fell, Verisk CargoNet found email compromise and misdirection schemes "remained comparatively stable" (Verisk).
"You're the one person who sees every email in the deal. That's exactly why they want to sound like you."
— Michael Thomas, Founder
How a payment redirect plays out
This is the common pattern, step by step.
- They get into a thread. A stolen login, or a look-alike address that slips into an existing conversation. Researchers call it email thread hijacking (Proofpoint).
- They wait. They watch the load move and learn the names.
- They send the change. After delivery, a "new factoring company" NOA or an ACH change request arrives, polite and on time.
- Accounts payable updates the record. It came from the thread, so it looks routine.
- The pay goes out. The carrier calls a week later asking where the money is.
A shipper-side version of this came at LFS: a look-alike web address angling for our bank details. Read Michael's account of that scam and how Shield shut it down before a reply went out.
The FBI also warns that overseas fraudsters use U.S.-based money mules to receive and forward stolen funds (FBI), which is why a new payee deserves a hard look. Keep your real NOA and W-9 on record in your LFS Compliance documents, so a forged one stands out. Shield tracks down where the person asking for the money actually is, and reports confirmed fraud to federal authorities, the FBI among them, on its own.
The FBI describes business email compromise as exactly this kind of scheme: a trusted-looking request to send money somewhere new (FBI).
Look-alike email domain red flags
Freight-specific guidance lists the top red flags: look-alike domains, a reply-to address that doesn't match the sender, and free email domains used for business (email spoofing guide).
Look for one swapped letter, an extra word in the domain, or characters from another alphabet that look like normal letters.
How to verify a payment change
FMCSA says to treat your company information like your banking information, and to notify your factoring company if it's misused (FMCSA).
How LFS Shield flags freight payment fraud
LFS Shield, our Circular Logistics Agentic Cybersecurity System, has watched payments in beta at LFS for more than three years and is part of LFS AOS.
- Payment Claim Guardian. Lines up the carrier you hired, the truck that hauled and whoever now wants the money. A changed factor or beneficiary needs independent verification before money moves.
- Email forensics. Flags look-alike characters, a reply-to that doesn't match the sender and new contacts inside an old thread.
- A clear label with the why. For example: REVIEW, because the NOA arrived from a domain registered after the load was booked, or HIGH, because the bank change came from an address that doesn't match the carrier's.
- Evidence vault. Keeps the emails, files and timeline for the factor, the insurer and law enforcement.
Dispatchers, keep going with our dispatcher and carrier guide and trucking cybersecurity and remote-access malware. More from Logistical Forwarding Solutions.
FAQ
What is freight payment fraud?
Redirecting a carrier's pay with fake NOAs, ACH change requests or emails that pose as a real party in the deal.
What is a fake notice of assignment?
A forged NOA telling the payer that a carrier's invoices now go to a different factoring company or account.
How do I verify a payment change?
Call the carrier and the factor on numbers you already had on file before changing anything.
Why are dispatchers impersonated?
Because they see every email in the deal, their name is the most useful one for a scammer to copy.
What if my dispatcher email was hacked?
Change the password, turn on multi-factor login, warn your brokers and carriers, and notify your factoring company.