High-Value Cargo Theft Is Rising: Build a Redirect-Approval Control

Cargo theft volume alone no longer describes the risk facing freight operations. Verisk CargoNet recorded 677 theft incidents in the United States and Canada during the second quarter of 2026, down 26% year over year. Yet estimated losses exceeded $304 million, more than double the prior-year period, as organized groups focused on higher-value freight.

That divergence, reported by Inbound Logistics, changes the security question. Shippers cannot judge performance only by how many incidents occurred. They must ask whether a criminal can alter a destination, appointment, contact, or carrier identity after a load has been tendered—and whether one employee can approve that change without independent verification.

A redirect-approval control turns a vulnerable communication into a managed exception. It preserves the original tender as the system of record, treats every material post-tender change as high risk, and requires verification through a trusted channel before instructions reach the driver or dock.

Fewer incidents can still mean greater exposure

The economics of freight crime have shifted from opportunistic theft toward targeted deception. A single load of electronics, pharmaceuticals, specialty food, copper, or branded consumer goods can produce an enormous return. Criminal groups therefore invest in stolen credentials, convincing email domains, carrier impersonation, social engineering, and knowledge of normal dispatch workflows.

The trend is visible beyond the loss total. FreightWaves reported that deceptive pickup schemes—using false identities, forged credentials, and carrier impersonation—rose 31% year over year in the first quarter of 2026. In another case, a driver acting on instructions from someone impersonating a broker placed more than $273,000 of frozen seafood at risk.

These events expose a process weakness. The shipment may have been correctly planned, tendered, and picked up. The theft succeeds later because a plausible message changes where the freight goes or who is authorized to direct it. Traditional controls at the gate do little if the driver receives a convincing redirect after departure.

Recognize a redirect before approving it

Define a redirect broadly. It is not limited to a new street address. Any post-tender change to the delivery location, appointment, receiving contact, phone number, email address, carrier, driver, tractor, trailer, pickup reference, or routing instruction should create a security event.

The event should collect signals across every channel involved:

• An email arrives from a new domain, a look-alike spelling, or a personal account.
• A known contact requests an urgent change but uses a new phone number.
• Portal instructions conflict with the original tender or transportation record.
• A broker asks the driver to bypass dispatch and communicate directly.
• Carrier identity, equipment, or driver details change shortly before pickup.
• A delivery location moves to a warehouse, cross-dock, parking area, or unfamiliar receiver not present in the original order.
• The requester applies time pressure, discourages callbacks, or claims normal verification is unavailable.

No single signal proves fraud. The combination determines risk. A legitimate consignee may need to move an appointment or use overflow space. The control must make verification fast enough that operations do not learn to evade it.

Require independent approval after tender

The strongest policy is simple: once freight is tendered, the person requesting a material change cannot be the person or channel that validates it.

First, freeze the original tender record. Keep its carrier identifiers, addresses, contacts, equipment details, appointment, and timestamps. Never overwrite those fields without retaining the previous values and actor history.

Second, open a change request linked to the shipment. Capture the requester, stated reason, source channel, proposed values, commodity, declared value, lane, and current freight location. Apply a higher approval tier to high-value commodities, unfamiliar destinations, after-hours requests, or multiple changes on one load.

Third, verify independently. Call a preapproved number already stored in the customer, consignee, broker, or carrier master record—not a number supplied in the change request. For carrier changes, confirm authority and insurance through established onboarding data and contact the known dispatch office. For destination changes, obtain confirmation from an authorized shipper or consignee contact through the established portal or corporate account.

Fourth, require a second approver with defined authority. The approver should see both the original and proposed instructions, risk signals, verification evidence, and freight value. High-risk changes may require security or management approval in addition to operations.

Finally, release one controlled instruction. The TMS should send the approved update to dispatch, the driver, and the receiving location from a recognized channel, with a version number and timestamp. Conflicting messages remain visible but cannot become executable instructions.

Measure prevention, speed, and severity

Incident count is a lagging measure and, as the 2026 data demonstrates, can improve while financial exposure worsens. A useful control dashboard should track:

• attempted redirects by channel, customer, commodity, lane, and shipment stage;
• changes blocked, rejected, or withdrawn during verification;
• average and 95th-percentile verification time;
• percentage of changes confirmed through a trusted master-data contact;
• overrides, who approved them, and why;
• loss frequency and loss severity by commodity and lane; and
• repeat domains, phone numbers, addresses, devices, carriers, and request patterns.

Review false positives as carefully as blocked fraud. If legitimate appointment changes routinely take an hour, teams will route around the control. Set service targets by risk tier: a low-risk appointment adjustment might clear quickly, while a new delivery address for a high-value load demands deeper review.

Make the shipment record the source of authority

Cargo thieves exploit fragmented decisions. Email contains one address, a text message contains another, the portal shows an old appointment, and the driver must decide which instruction sounds credible. A TMS can eliminate that ambiguity by recording the accepted tender, enforcing change permissions, preserving an audit trail, and distributing only approved instructions.

CXTMS helps freight teams centralize shipment events, contacts, documents, and exception workflows so a suspicious redirect becomes visible before cargo changes course. Request a CXTMS demo to see how controlled approvals and shipment-level audit history can strengthen freight security without slowing every load.