Cyber-enabled criminals are exploiting artificial intelligence and increasingly complex supply chains to divert high-value cargo without ever physically hijacking a truck.
According to Valorie Steinbeck (pictured), practice director of marine and logistics at Crawford & Crawford, generative AI could further increase the sophistication and scale of cargo fraud by helping criminals access platforms, analyze freight information or produce convincing communications and documentation.
At the same time, geopolitical instability, route changes, transportation delays and the rapid onboarding of new carriers and suppliers are making supply chains more complicated. Each additional participant, platform and handoff creates another potential opening for criminals.
“The more layers and complexity you have, the more open doors there are to infiltrate,” Steinbeck said. “Fraudsters are exploiting periods when companies are rapidly onboarding new carriers and suppliers as they shift and move with the environment. As these changes happen internally, they create vulnerabilities. As we all know, fraudsters exploit vulnerabilities.
“It’s about watching all of this and doing our best to adapt and evolve as things change. As an industry, we need to develop tools, platforms and other ways to help mitigate and prevent some of these infiltrations.”
The cargo theft landscape has changed significantly over the last three to five years. Organized groups are increasingly manipulating the digital systems used to assign, release and transport freight. Using social engineering and organized criminal networks, they’re “stealing identities, creating fake motor carriers, spoofing emails, issuing fraudulent pickup instructions and diverting legitimate loads,” Steinbeck said.
“The key difference we’re seeing today is that (cargo theft) is strategic,” she added. “They don’t actually take the load by force anymore. It’s all about breaking the supply chain.”
In these schemes, warehouses and shippers may voluntarily release cargo to criminals because the identification, insurance documentation and pickup instructions presented to them appear legitimate.
Fraudsters may use stolen or misappropriated US Department of Transportation numbers, altered insurance certificates, fake driver credentials or email addresses designed to imitate those of genuine businesses.
The shift is changing how adjusters investigate losses. Cargo theft claims traditionally centered on physical evidence, including damage to trailers, locks or warehouses. Strategic theft requires claims professionals to examine email systems, dispatch logs, load-board activity and digital chains of custody.
“When we look at a claim now, we’re looking at both the physical and digital sides to evaluate where the break occurred,” said Steinbeck.
Adjusters must determine how the fraud happened, when the cargo was diverted and which participant may have failed to follow required procedures. A compromised email account or stolen carrier identity may also be used to target several shipments rather than a single load.
Evidence preservation is therefore becoming an early priority. Emails, headers, CCTV recordings and dashcam footage may be deleted or automatically overwritten before investigators can examine them.
“The faster the decision is made to notify everyone to preserve the evidence, the better positioned the adjuster is to define what happened and whether the claim is covered,” Steinbeck said.
Common gaps include a lack of documented carrier-verification procedures, missing tender and dispatch records, changed phone numbers, deleted emails and an inability to confirm that a driver was connected to the carrier whose authority was presented.
Those deficiencies can trigger disputes among shippers, brokers, carriers, warehouses and insurers over where responsibility lies and whether security conditions in the policy were satisfied.
The increasing value of stolen freight is adding urgency to the problem. “We went from an average claim of $202,000 to $336,000 in the third quarter of 2025,” Steinbeck noted. “The increase is significant, so the insurance industry obviously needs to respond.”
In response, some shippers are purchasing shipper’s interest coverage, a form of first-party protection that may include cyber-related endorsements. Where that coverage is absent, the loss may fall to the carrier or another party involved in transporting the goods.
Steinbeck said policy language is continuing to evolve as insurers consider which cyber-theft events should be covered and what security obligations transportation companies must meet.
Carriers are paying closer attention to dual authentication, driver validation, email verification and the preservation of dispatch records. Insurers recognize that not every theft can be prevented, she said, but they increasingly expect insureds to demonstrate that employees were trained and documented safeguards were followed.
Companies can strengthen their position by establishing formal security programs, using multiple authentication steps, verifying carrier identities and preserving all load, dispatch and communications records. Those controls may not eliminate theft, but they can help investigators reconstruct the timeline, identify the point of compromise and involve organizations such as the National Insurance Crime Bureau, CargoNet or the FBI before the cargo disappears.
“We can’t shore up every edge, but those are clear defences that will certainly help with a claim,” Steinbeck said.
