Freight Fraud Signal Checker
Paste a freight email with its headers, a rate confirmation or a carrier's details. It scores remittance change requests, spoofed senders, lookalike broker domains, RMM installer links, double brokering cues and FMCSA registry mismatches.
Fictional sample. Companies, people, phones and .example domains are made up, and the FMCSA record shown is a sample row.
The text stays in this tab. Only a USDOT or MC number, when present, is sent to FMCSA's public data at data.transportation.gov.
How the checks work
Header lines at the top of the paste are read as an email: From, Reply-To, Return-Path and Authentication-Results. Links, addresses, bare domains, USDOT and MC numbers, phones and the company name are pulled from the rest. Each signal adds its score; 60 or more, or two high signals, is a high verdict, and 25 or more is medium.
The FMCSA check reads the Company Census File for name, status, add date, email and phone, the Motus carrier dataset for operating authority, and Motus authority history for the grant date. The older Carrier and AuthHist datasets stopped updating on 14 May 2026, so the Motus versions are used.
Freight fraud FAQ
Is the email I paste uploaded?
No. Parsing and scoring run in JavaScript on this page. The only request that leaves the browser is the USDOT or MC number, sent to the public FMCSA datasets on data.transportation.gov, and only when the text contains one.
Which FMCSA data does the carrier check use?
Three public, keyless datasets on data.transportation.gov: the Company Census File (az4n-8mr2) for legal name, status, add date, email and phone; Motus Carrier - All With History (inys-ebih) for operating authority status by docket; and Motus AuthHist - All With History (yu5v-wbh6) for the date authority was granted. If the request fails, the page gives SAFER lookup links instead.
What is the 2025 cargo theft pattern with RMM tools?
Proofpoint reported on 3 November 2025 that criminals compromised load board accounts and broker email threads, then sent carriers links to .exe or .msi files that installed remote management tools such as ScreenConnect, SimpleHelp, PDQ Connect, Fleetdeck, N-able and LogMeIn Resolve. With that access they booked loads as the victim carrier and stole the cargo.
Why does a passing DMARC result not make a message safe?
DMARC proves the message came from the domain's own mail system. When a broker's or carrier's mailbox is taken over, the attacker's messages pass SPF, DKIM and DMARC. That is why the page also scores links, file types, install requests and payment changes on authentic mail.
What should I do before paying a changed bank account?
Hold the payment and call the vendor on the phone number you already have on file, never one from the email, and confirm the change with someone you know there. Require a second approver for bank changes.
FMCSA field names follow the MCMIS Company Census data dictionary (Rev 8, January 2026) and the Motus operating authority datasets as of October 2026. Protected domains were checked against FMCSA census email records or the company's own site on 20 October 2026. Samples are fictional.