Hunted, traced and reported.
Origin tracing that looks past the mask
A VPN or a proxy is a costume, not a hiding place. Shield reads the email route, the servers it touched and the fingerprints left in document metadata to find the real starting point. Our methods stay proprietary.
Fraud reports filed without waiting on paperwork
No form to fill out after a long day. When the evidence is there, Shield sends it to federal and transportation authorities itself, so the people behind it face consequences.
Scanning built into every upload
Drivers snapping a POD in the cab, brokers emailing a packet, shippers sending a rate con: each file is opened safely inside Shield first, never on your computer.
Every one of these layers comes free. Here's the honest reason we give it away. Why LFS Shield is free →
Part of one circle: Logistical Forwarding Solutions, LFS AOS, LFS Compliance Pro and Freight Broker Complaint, all fighting the same fraud.
Malware and antivirus defense
Every attachment is treated as hostile until LFS Shield clears it. Files go into quarantine and are inspected safely, never opened on your machine first.
What it checks
- Quarantines incoming attachments before anyone opens them
- Inspects PDF, Office, image and archive files structurally
- Detects macros and embedded scripts
- Catches spoofed extensions and disguised file types
- Follows links and redirects to where they really go
- Spots remote-access-tool lures
What it flags
- A "rate con.pdf" that is really a program
- Office files carrying macros
- Archives hiding executables
- Links that redirect to credential-harvesting pages
- rate-con.pdf · file type matchesCLEAR
- carrier-packet.docm · macro foundTHREAT
- invoice.zip · hidden executableTHREAT
- pod-scan.jpg · cleanCLEAR
Document scanning and tamper fingerprints
Rate cons, carrier packets, BOLs, PODs, W-9s, insurance certificates, invoices, notices of assignment and ACH change requests are read, compared and fingerprinted.
What it checks
- Extracts load number, rate, parties, pickup and delivery
- Compares every version of a document against the last
- Matches issuer and recipients against verified records
- Fingerprints each file (SHA-256) so any byte change shows
- Compares the BOL and POD against the rate con
What it flags
- A rate that changed between versions
- A remit-to that doesn't match the contracted carrier
- Altered delivery address on a revised rate con
- A file changed after it was signed
- Rate con v2 · rate unchangedCLEAR
- Rate con v3 · remit-to changedTHREAT
- BOL · matches rate conCLEAR
- Fingerprint · byte change after signatureTHREAT
Email checks
LFS Shield reads the email behind the email: who really sent it, through which servers, and where its links go.
What it checks
- Sender vs Reply-To and Return-Path
- SPF, DKIM and DMARC authentication results
- The full header chain
- Look-alike domains, including letter swaps and Unicode look-alikes
- Links and redirects
- Brand-new contacts on an existing account
What it flags
- "Change your password" and "open this carrier packet" lures
- A reply-to that points somewhere else
- A domain one letter off from the real broker
- Unexpected payment or freight instructions
- From and Reply-To matchCLEAR
- DMARC · failTHREAT
- Domain · one letter off the brokerTHREAT
- Links · resolve to the sender's domainCLEAR
Domain and company identity
Is this company who it says it is? LFS Shield checks the web address, the registration and the official records, and it never lumps two similar names together.
What it checks
- Domain age and registration (RDAP)
- DNS records and the company's known website
- A phone number verified on its own, not from the email
- Legal name and DBA
- USDOT and MC numbers, FMCSA operating authority and history
What it flags
- A website registered days ago claiming a decades-old brand
- A phone number that isn't on the official site
- Contact details that don't match FMCSA
- An authority that doesn't fit the claimed role
- Domain age · 8 daysTHREAT
- FMCSA authority · activeCLEAR
- Phone · not on official siteTHREAT
- Legal name · matchesCLEAR
The Transaction Identity Chain
This is what makes LFS Shield different. For every load it keeps a time-stamped identity trail across five handoffs and compares each one, so it catches impersonation even when the named company is real and reputable.
What it checks
- A · Who posted or offered the load
- B · Who negotiated and gave instructions
- C · Who signed or issued the rate con
- D · Who physically hauled and delivered it
- E · Who submitted the invoice and claims the money
What it flags
- A load-board posting answered from an unknown email
- A POD that suddenly must go to a third-party domain
- A new factoring company claiming the proceeds
- A handoff that breaks the chain, without accusing the real broker being impersonated
- A · Posted · verified brokerCLEAR
- B · Negotiated · same contactCLEAR
- C · Rate con · look-alike senderTHREAT
- D · Delivered · our truckCLEAR
- E · Paid to · unknown partyTHREAT
Freight and cargo checks
LFS Shield watches the freight itself, from offer to delivery.
What it checks
- Load-board poster vs the authorized broker
- Every rate con issued on a load
- Dispatcher, driver and truck assignments
- Pickup and delivery addresses and release instructions
- Proof-of-delivery lineage
What it flags
- Double brokering patterns
- A second rate con on the same load
- A new dispatcher, driver or truck out of nowhere
- A changed pickup or delivery address
- Unapproved release instructions
- Rate cons on load · 1CLEAR
- Rate cons on load · 2THREAT
- Delivery address · changed after bookingTHREAT
- Driver · assigned and verifiedCLEAR
The Payment Claim Guardian
Your right to be paid is the last thing a scammer steals. LFS Shield ties the money to the load: who was hired, who hauled it and who is claiming payment.
What it checks
- Which carrier was hired and which one hauled
- Where the POD and invoice are supposed to go
- The verified factor or beneficiary on file
- Notices of assignment and ACH change requests
- Competing invoices for the same load
What it flags
- A bank or factor change that arrives by email
- Two invoices on one load
- Payment routed to a party that didn't haul it
- It requires independent verification before money moves
- Factor on file · unchangedCLEAR
- ACH change request · by emailTHREAT
- Invoices on load · 2THREAT
- Beneficiary · matches carrierCLEAR
Three levels of response
Fast when everything is normal. Serious when it isn't. Never reckless.
What it checks
- Level 1 · Routine: fast scripted checks on every message, file and load
- Level 2 · Targeted review: correlates identity, domain, registration, history and payment, with reasons
- Level 3 · Critical hold: preserves proof, opens a private incident and holds only the affected action until a supervisor clears it
What it flags
- It never stops a moving truck
- Only the affected approval is held, nothing else
- A supervisor can release it, with a reason on record
- Level 1 · 214 checks · clearCLEAR
- Level 2 · review · reasons attachedREVIEW
- Level 3 · hold on payment changeTHREAT
Plain-English results
No mystery scores. Every result says what it found, why it matters and what to do next.
What it checks
- States: CHECKED, REVIEW, HIGH, CRITICAL, HUMAN CLEARED
- Every label has a why
- The supporting evidence, one tap away
- What's unknown, stated plainly
- A safe next step
What it flags
- "Call the broker on a number you looked up on your own, not the one in this email."
- CHECKED means nothing was found in current data. It is never a promise of safety.
- CHECKED · nothing foundCLEAR
- REVIEW · new domain, 8 daysREVIEW
- HIGH · payment change by emailTHREAT
The evidence vault
When something goes wrong, proof matters. LFS Shield keeps it, untouched.
What it checks
- Original files and emails, kept byte for byte
- A fingerprint and version for every item
- A custody timeline: who touched it and when
- An access log
- Private, secure retrieval and legal hold
What it flags
- Any change to stored evidence
- Access by anyone without permission
- Original email · preservedCLEAR
- Fingerprint · verifiedCLEAR
- Custody timeline · 4 eventsCLEAR
Fair by design
Protecting carriers never means smearing an honest company.
What it checks
- Separates allegations from evidence
- Filters out complaint floods and brigading
- Allows appeals and corrections
- Gives the other side a right of reply
- Lets old signals expire
What it flags
- It never puts an automatic "scammer" label on anyone
- No blacklist, and no membership buys a better rating
- A real company being impersonated is treated as a victim, not a suspect
- Duplicate complaints · mergedCLEAR
- Unverified allegation · not a findingREVIEW
- Impersonated broker · marked as victimCLEAR
Agentic, circular learning
LFS Shield is agentic: it researches, compares and explains on its own, while people keep the final say. And it's circular. Every scam that hits one carrier makes LFS Shield smarter for all of them.
What it checks
- Signals: emails, loads, documents and payments
- Detection: what doesn't match
- Investigation: the evidence is preserved
- Learning: each case becomes a lesson, with personal details removed
- Better detection: the next carrier is protected
What it flags
- One attack seen. Every carrier protected.
- Lessons flow from LFS AOS, LFS Compliance Pro and Freight Broker Complaint into MT's brain, and back into LFS Shield
- New pattern · learnedCLEAR
- Shared to every tenant · details removedCLEAR
- Next attempt · flagged on arrivalTHREAT
Twelve layers between your truck and the fraud rings.
You haul the load. Shield stands behind you on every email, file and payment change, one layer after another. It's free, because protecting small carriers is our job.
Request early access