LFS Shield · Articles

LFS Shield Just Saved a Company: Inside the Fake Shipper It Caught

By Michael Thomas, Founder, Logistical Forwarding Solutions

The bait

Picture the dream inquiry. Somebody fills out the form on our website claiming to speak for a big, publicly traded maker of consumer products. Grocery store brands. Pharmacy brands. Names everybody recognizes.

He wants rates on 50 loads. Long haul, a little Western town down to the Southeast. Pricing, capacity, transit times, extra fees. "Dear Transportation Partner," it starts. And he ticks the box that says texting him is fine.

For a young brokerage or a hungry dispatcher, that's rent, payroll and a good month in one message. That's exactly why it's built that way.

This article tells it from the other side of the screen, the way LFS Shield, our Circular Logistics Agentic Cybersecurity System, saw it. For my own telling of the story, plus the bank-account scheme behind it, read the original fake shipper warning.

"The bigger the name on the request, the harder you check."

— Michael Thomas, Founder

Check one: the domain's birthday

Before a person on our team even read the message, LFS Shield started pulling registration records.

The real manufacturer has owned its web address for years. The sender's address was the brand name with "usa" tacked on. LFS Shield looked up that domain and found it was born eight days before the email hit us, through a cheap registrar overseas.

Eight days. A company with shelves full of products across the country doesn't suddenly get a new email domain the week before asking a stranger for 50 loads.

That number is small, but the crew behind it isn't new. Rings like this set up throwaway companies and copycat sites by the hundreds, run them a few weeks, then toss them.

Checks two through five

One red flag can be an accident. LFS Shield doesn't stop at one. It kept going.

1. The email domain. LFS Shield compared the sender against every contact listed on the manufacturer's own official site. All of them use the real domain. None use the "usa" copy.
2. The phone. The number carried the area code of the real headquarters. That's a trick, not a match. Anyone glancing at it relaxes. LFS Shield treats a phone number as unverified until it's confirmed from an independent source.
3. The lane. The manufacturer publishes where its North American plants are. Not one sits near that pickup town. Fifty loads from a place the shipper doesn't operate is a question, not an opportunity.
4. The channel. Real shipping departments run bids through email, procurement portals, credit terms and signed contracts. This one wanted to move a 50-load program into a private text thread.
5. The documents. Nothing was attached and nothing was signed. A brand-new contact angling for our pricing, capacity and a text line is a classic lead-in to asking for a carrier packet, a W-9 and bank details. LFS Shield made sure none of those went out to an unverified party.

Check six: where the message actually started

A US-looking website and a US area code only tell you what the sender wants you to believe. So LFS Shield went after the one thing a scammer can't easily fake: where the message actually started.

Why the IP? Because every email, attachment and web request leaves a trail back to a machine and a network. An everyday IP lookup reads one address and stops there, and a cheap VPN fools it. LFS Shield doesn't stop there. It works through the email headers and the mail servers that handed the message along, the metadata buried inside PDFs and other documents, the data embedded in attached files, and the network and routing path the traffic took. VPNs and proxy servers don't stop it. LFS Shield pinpoints where a fraudster really is, down to their exact location. If they come in, we find them.

All of that answers one question. Is this a real American business running under genuine FMCSA carrier or broker authority, or an operation outside the country wearing a US mask?

Not just shippers

Fake shippers are one front. Chameleon trucking companies, chameleon brokers and chameleon dispatchers are being operated from outside the United States as well. FreightWaves has traced much of today's freight fraud to offshore criminal groups in places such as Eastern Europe, India, Pakistan and Africa. Federal charges filed in 2025 describe Armenia-based call centers that allegedly registered carriers and brokerages with FMCSA under fake US business addresses and spun up fresh companies whenever complaints caught up with them. The way in rarely changes: bought or stolen MC numbers, copycat domains, VPNs and proxies that make a foreign connection look local, and US money mules who catch the cash and pass it on.

None of this is aimed at the people who live in those countries. They aren't the problem. Organized criminal rings are, and those rings work out of American towns too.

What we keep to ourselves

The IP trail is only the first layer. LFS Shield also runs location checks of our own that we keep private on purpose. Publishing them would just teach fraud rings how to dodge them. They were built and sharpened over more than three years of real attacks on our own company, and they reach well past the basic lookups other tools rely on.

It reports them on its own

When LFS Shield pins down a fraudster, it doesn't wait for someone to fill out a form. It automatically reports them to multiple authorities, including FMCSA, the FBI and the US Department of Transportation, with the IP addresses, the subjects involved and what happened, so the evidence is on record while the trail is still warm.

The verdict

LFS Shield marked the inquiry as fraud. Not a vague "be careful." A plain-English list: domain registered eight days ago, email doesn't match any official contact, lane doesn't fit the company's locations, request pushed off the record.

Shield also located the sender behind the brand name, down to where they were actually sitting. FreightWaves has reported that many of these rings run from overseas, beyond the reach of U.S. courts (FreightWaves), so knowing where a message really came from matters.

Every reason came with its evidence. The message, the domain record and the comparison were logged, so we can hand the whole thing to investigators.

"It didn't just say no. It told us why, and it kept the receipts."

— Michael Thomas, Founder

What got saved

Here's what didn't happen, and why it matters.

• No quote went out. The scammer got none of our pricing.
• No documents went out. No carrier packet, no W-9, no insurance certificate to be reused under our name.
• No bank details went out. That's the real prize. With a routing and account number, these crews print counterfeit checks against your account and use your company name to hit other businesses. Police have reached out to LFS three times over people impersonating us that way.
• No time got burned. Nobody spent a week chasing 50 loads that never existed.

Verisk CargoNet puts cargo theft losses at about $725 million in a single year in the U.S. and Canada (source). Plenty of that starts with an email like this one. This time it ended at the first check.

Run the same checks yourself

Until you have LFS Shield, do it by hand. Every new shipper, every time.

Go deeper with the plain overview of Shield, Shield for the people who book loads and the case for protecting your trucks. For compliance documents, see LFS Compliance. More from Logistical Forwarding Solutions.

Report it

FAQ