Episode 17: How to spot cybercrime and freight fraud

Benjamin Wilkens on how to spot cybercrime and freight fraud

[00:00:00] Benjamin Wilkens: We see that a lot of times in cybercrime fraud. Whether it’s a romance scam or freight fraud, the same tactics are used: you build the trust and you move it off platform. So that’s always a red flag.

[00:00:13] John Howland: All right. Hello and welcome to a quick market update from the one and only Mr. Avery Vise. For those of you guys that don’t know him, Avery is the Chief Trucking Analyst at FTR Transportation Intelligence. He is the man that tracks freight markets and rate trends across the industry.

Avery joins us monthly to share his insights and, of course, his knowledge. So, Avery, thank you for joining us today.

[00:00:37] Avery Vise: Good to be with you, John.

[00:00:38] John Howland: Good. So question number one, in one word, no context, I want one word: How would you describe the freight market over the last month?

[00:00:47] Avery Vise: Stable.

[00:00:48] John Howland: Stable. Good. I like it. Why stable?

[00:00:51] Avery Vise: Well, yeah, stable. You know, a lot of people think stable might imply sluggish or weak or whatever. That’s really not the case. Stable means that spot rates are very high.

They’re running 45%-ish year over year, and they’ve been in that territory for the past month, actually, even longer. They’re moving pretty much in line with seasonal expectations. This is a time of the year between Labor Day and, oh, maybe a week or two before Thanksgiving where you just don’t see very much change, typically.

Now, you might have thought, “Okay, well, this year’s different because you had a record diesel price back in September; you had a big surge leading up to that.” It didn’t really change much, and a lot of people were like, “Okay, well, that means the market’s weak.”

No, I don’t think so. I think what it means is that rates are running 45% higher than they were a year ago. Whereas if you go back to March, when we had the same phenomenon, rates were only 12, 15, maybe 20% higher, which is still good, but nothing compared to what it is now.

So I think basically what has happened is that rates are strong enough at this point that carriers might still have some cash flow issues with diesel, although at this point, that probably has settled.

But they don’t necessarily need any more cost recovery, and they’re not necessarily going to be pressuring brokers for more money just because the diesel price is higher. They’re still making out very well. Yeah, so you say stable, you say pretty consistent. It’s a significant growth year over year, right?

[00:02:22] Avery Vise: Yeah, absolutely.

[00:02:23] John Howland: Do you think fuel is the main driving indicator of that, or why has it spiked and continuously stabilized at that clip?.

[00:02:31] Avery Vise: It spiked because of capacity shortfall and disruption. We’ve had spikes in diesel prices before, especially in 2022, that didn’t really have that effect, and that’s because there was not a capacity shortfall.

We’ve had a capacity shortfall for a while, well, maybe not relative to freight, but certainly we were at a capacity level a year ago that is similar to where we are now. But there was no disruption; there was no increase in freight.

Freight has improved. It’s especially strong in flatbed, primarily due to data centers, but it has improved also for dry van and refrigerated. So those factors have come together to create that environment. But it did seem to peak out around the middle of the year, and it has now been moving seasonally, as I said. And it probably will be like that for a while.

Obviously, there will be a spike around Thanksgiving, at least in refrigerated, and there will be a spike in dry van and refrigerated at year-end. There always is; there never has been a year when that hasn’t happened. And then next year, if it goes the way we think it will, spot rates will still be very strong well into next year.

But the year-over-year changes obviously will collapse because by the time we get to April and May, we’re going to be getting close to where we are. So don’t get too hung up on growth getting smaller. At FTR, we’re actually forecasting spot rate growth next year, and that is extraordinarily unusual to have in a year where spot rates are already up to the degree they are.

If you take out a fuel surcharge just to adjust for cost, you end up with more like 36% year over year for the year. But we’re looking at another 7% or 8% increase next year, and that just doesn’t normally happen. If you look at 2019 or 2022, you have these fairly substantial normalizations just because the run-up was so great.

We don’t really see that happening. It’s going to slow, but it’s still going to be very strong.

[00:04:30] John Howland: So what are, again, kind of those leading indicators in terms of why you feel like it’s going to spike?

[00:04:35] Avery Vise: I think basically it’s capacity. There’s not any real opportunity for a surge in capacity. Yes, employment levels are coming up. We will get the jobs report for October on Friday, and there will probably be another increase then, maybe very large.

But if it follows the pattern that has been occurring, it’ll be modest, which is not what normally happens in the kind of rate environment that the trucking industry is experiencing now. Usually you get a very robust month or two with double-digit job gains in payroll employment. We haven’t had anything close to that this year so far.

And it’s foreign driver enforcement and a whole host of issues, including fuel prices, which no doubt have knocked out some carriers and sent some drivers looking for other work.

[00:05:23] John Howland: Yeah, good. I know the holidays are coming, they’re going to be here before we know it. So what advice could you give to carriers as we’re coming into the holiday season through the rest of the year?

[00:05:33] Avery Vise: Well, the biggest advice, although it’s not as important this year as it usually is, is don’t get too hung up on the fact that spot rates for van, especially refrigerated van, but also dry van, will increase around Thanksgiving and surge at the end of the year due to an extreme capacity shortfall.

Pay no attention to that. Take advantage of it, sure, take that money to the bank! But don’t think that means we’re going to have another round of rate increases. There’s really not a scenario, barring some sort of dramatic change in freight demand that we don’t see on the horizon, that would lead to another round of surges in spot rates.

I think spot rates have about peaked out, other than those seasonal increases that we’ll see later this month and in December. But don’t expect another round of that. Could it happen? I guess, but the scenario that would create that is very difficult to come up with.

[00:06:33] John Howland: Well, that is wonderful advice, sir. I always appreciate having you on, so thank you for your quick market update. This is John with Behind the Freight, and Avery, appreciate you, sir.

[00:06:43] Avery Vise: Thank you. So long.

[00:06:48] John Howland: Hello and welcome to another episode of Behind the Freight. Today, we’re talking about a threat that can hit a trucking business without anyone ever touching a truck: cybercrime.

Fake brokers, stolen identities, hacked accounts, and so many different things, one convincing email or phone number can put your freight, your money, or your business at tremendous risk.

Joining us today in this conversation is Mr. Benjamin Wilkens. He is the Director of Cybersecurity at the National Motor Freight Traffic Association, where he helps trucking companies protect themselves against digital threats. Welcome, Benjamin.

[00:07:26] Benjamin Wilkens: Thanks for having me. Happy to be here.

[00:07:28] John Howland: Yeah, of course, of course. Looking at cybersecurity as a landscape, there are so many threats and so many things happening each and every single day.

What is one thing happening right now that you think every carrier and broker should be paying very close attention to?

[00:07:46] Benjamin Wilkens: If I can answer that by saying there are actually two things that I would recommend everybody pay attention to, I’ll give you my top two. Number one: social engineering has evolved to a level of sophistication that we’ve never seen before. Everybody’s talking about AI, AI this, AI that.

AI is facilitating a level of quality in social engineering lures and attacks that we haven’t had to face historically, and it’s also lowering the bar, making it much more accessible for threat actors. So that would be number one.

There’s kind of a two-pronged impact of AI, and the other is on the supply chain: upstream risk introduced by vulnerabilities in the tools we use. They’re being exploited faster and at a much greater scale than what we’ve seen in the past because it has lowered the barrier of entry for bad actors.

[00:08:38] John Howland: Social engineering, first time I’ve heard that. Can you explain at a very high level for the audience what that is?

[00:08:46] Benjamin Wilkens: Sure. At its basic form, social engineering is just the art of getting somebody to do something that they wouldn’t otherwise do or shouldn’t do, whether that’s clicking on a link, providing information, sharing a login, or anything like that.

It can be in the form of phishing emails with a malicious link, or somebody calling you, what we call vishing, or voice phishing, where they pick up the phone, pretend to be somebody they’re not, and talk you into doing something. And we see that all the time in the freight world.

[00:09:12] John Howland: I’ve heard many small trucking companies say, “I’m too small for a hacker to even care about.” How dangerous is that statement or assumption for smaller brokers or carriers to feel?

[00:09:26] Benjamin Wilkens: Extremely. It couldn’t be farther from the truth. They may not be targeted specifically by a nation-state actor like what you think about when you picture hackers and cybercrime, but most of these are crimes of opportunity.

Cyber threat actors throw out a whole bunch of lures, and whoever bites, it doesn’t matter what size the company is: you could be a single-truck owner-operator, a 10-truck fleet, or a 5,000-truck fleet, they’ll just right-size their attack to your operation once they get a hook.

[00:09:55] John Howland: Yeah, so the message there for everyone: be on the lookout, and be aware that if it looks fishy, it probably is.

[00:10:02] Benjamin Wilkens: Well, and the other thing is that smaller operators don’t have a security budget or security teams in place. They naturally don’t have the defenses in place to combat these types of attacks.

[00:10:13] John Howland: Yeah, and when I hear cybersecurity, I always envision a little guy behind a computer hacking away, probably from seeing too many movies or shows. In the trucking industry, scams seem to be a little bit different.

It’s not a guy on a keyboard; it’s actually somebody pretending to be somebody else through phone calls, emails, and those sorts of things, right? Yeah. So what does it look like when somebody steals a legitimate carrier’s or broker’s authority or identity?

[00:10:37] Benjamin Wilkens: Absolutely.

[00:10:38] John Howland: Yeah. So what does it look like when somebody steals a legitimate carrier’s or broker’s authority or identity?

[00:10:44] Benjamin Wilkens: It can go a couple of different ways, whether they actually take over accounts or just masquerade and use your legitimate information without permission, using your MC number and masquerading as you, the legitimate carrier.

Often what we see first is the compromise of an email account through a phishing lure: somebody clicks a link they shouldn’t have, and their account is compromised.

Threat actors then monitor communication, access conversations about ongoing transactions or planned shipments, and set filters so only they receive incoming emails. They respond to trading partners saying, “Yeah, we’ll take this shipment,” booking freight using this legitimate email.

Once they have the freight, they’ll act like the dispatcher or broker and contact the driver directly to change the destination, saying, “The shipper changed the location; we’ve got to go to Warehouse B instead of Warehouse A.”

Warehouse B is controlled by the bad actor, so the load gets delivered, the driver is none the wiser, the bill of lading gets signed, and the freight gets laundered, broken down, and cross-docked right there.

[00:11:57] John Howland: What are some ways carriers and brokers, mainly carriers, can mitigate this or double down on ensuring that if there is a change or anything different from the rate confirmation sheet, it’s legitimate?

Would you advise that they double- or triple-call their contacts? What should they do if somebody calls to change information like that?

[00:12:17] Benjamin Wilkens: It starts proactively with training and putting processes in place. What are the acceptable communication channels that can be used to make these changes? Who is authorized to make them?

What is the protocol if a driver gets contacted and the broker says the destination has changed? What is that driver trained to do in that moment: just take the broker’s word, or contact dispatch? Do they tell the broker, “Hey, you’ve got to go through my dispatch,” if they’re hauling outside freight?

It’s about training people in advance to have a level of skepticism where they don’t take things at face value. It’s unfortunate that we have to go that way, but there are so many compromised accounts, fake brokers, and stolen identities that we have to be politely paranoid while maintaining business relationships.

[00:13:15] John Howland: What is one of the craziest, most sophisticated incidents you’ve seen in this industry where you stepped back and thought, “Whoa, that was really clever,” or, “We need to pivot and start thinking differently”?

[00:13:40] Benjamin Wilkens: It’s hard to pick just one, but one that always stands out in my mind involved a stolen shipment of high-dollar gaming consoles destined for a major online retailer.

The shipment was stolen, and the freight was then laundered by drop-shipping it on that same online retailer’s platform.

The load was originally booked to transit to that online retailer’s warehouse, got stolen, and was then rebooked, shipped back, and sold through that exact same platform. The level of sophistication and forethought that goes into something like that is just crazy.

[00:14:26] John Howland: That’s wild! Our founder and CEO, Scott Moscrip, is actually working with people to produce a movie called Grand Theft Cargo, following a day in the life of a carrier and what they do to avoid fraud.

Being in this industry for almost 35 years, he has seen so many examples, so we’ll see if that gets additional legs and gets off the ground.

[00:15:07] Benjamin Wilkens: Keep me posted on that. I’d be very interested.

[00:15:10] John Howland: You could be an actor, Ben, you’ve got the face for it! Let’s go!

Let’s segment over to a little game called Red Flag, Green Flag. I’ll give you a couple of scenarios; you tell me whether it’s a green flag, a red flag, or if you need more information, and provide context on what should happen next.

[00:15:33] Benjamin Wilkens: Okay, sounds good.

[00:15:34] John Howland: Scenario one: “The Familiar Broker.” You’ve hauled for the same broker for years.

One morning, someone claiming to be your usual contact texts saying they’ve changed phone numbers and wants to move the conversation to WhatsApp. Is that a red flag, a green flag, or do you need more information?

[00:15:54] Benjamin Wilkens: No more information needed, that’s a massive red flag. Anytime somebody wants to move a conversation off-channel to another type of communication channel, it’s a big red flag.

That’s typically somebody who has compromised an email account but wants flexibility without the risk of getting caught, so they move to an encrypted messaging app.

We see that a lot in cybercrime fraud: whether it’s a romance scam or freight fraud, the same tactics are used, you build trust and move it off-platform. That’s always a red flag.

[00:16:29] John Howland: If I’m a driver, what is the safest way to confirm that the person is the right person?

[00:16:36] Benjamin Wilkens: Reach back out using a trusted communication channel that you initiate.

If they email you saying they need to move the conversation to a new phone number, don’t answer that email, call the broker’s number you already have on file and ask if it’s legitimate.

If they call you, hang up, email your trusted contact, and ask, “Should I be expecting this phone call?” Always rely on preplanned, authorized communication channels. Any deviation should be a red flag.

[00:17:11] John Howland: Scenario two: “The Login Emergency.” You get an email saying your load board account has been suspended, with a link to restore access within 30 minutes. Red flag, green flag, or need more information?

They seem obvious, but they work, and people still click them, right?

[00:17:36] Benjamin Wilkens: The reason they work is artificial time pressure. In social engineering, attackers use urgency, threats of authority (like impersonating the DMV, police, or IRS), or fear of missing out.

That time pressure is the red flag. In this situation, navigate directly to the load board yourself and try logging into your account.

Often, you’ll find you can log in without any issues, proving the alert was fake. Always be cautious with unsolicited links.

[00:18:38] John Howland: Scenario three: “The Perfect Paperwork.” A new carrier sends over authority information, insurance certificates, and company details. Everything looks professional, but the email address doesn’t match the company’s official domain.

Red flag, green flag, or need more information?

[00:18:56] Benjamin Wilkens: Another red flag. Lookalike domains are a common tactic: if the real company is Benstrucking.com, they might send an email from Bentrucking.com.

Lookalike domains allow someone to spoof a carrier’s identity without even compromising their accounts, convincing others to book loads with an imposter. That’s definitely a red flag.

[00:19:24] John Howland: Scenario four: “The Payment Update.” You delivered a load and are waiting on payment. You get an email appearing to come from your factoring company saying your payment is on hold and you must re-enter banking details through a link to release funds.

Red flag, green flag, or more information?

[00:19:44] Benjamin Wilkens: I’m Mr. Red Flag today, these all tickle my Spidey-sense! Anytime there’s unexpected communication regarding banking changes, that’s a red flag.

Unless you were already coordinating payment updates with your trading partner, clicking an unsolicited link to enter banking details into a web portal without verification is never a good idea.

[00:20:15] John Howland: Of those four scenarios, which one catches most people off guard?

[00:20:24] Benjamin Wilkens: We see a lot of success with lookalike domains. Our industry operates at a rapid pace, and subtle visual tricks, like swapping the letter “l” for the number “1”, are very easy to overlook at normal operating speeds.

[00:20:49] John Howland: We sent out surveys to our carrier and broker audiences for “Advice from the Road: Know Who You’re Working With.”

If you’re an owner-operator booking with a broker you’ve never worked with, what are the first three things you should check to verify them?

[00:21:18] Benjamin Wilkens: Well, first of all, you want to make sure that their information with FMCSA matches what they’re giving to you. You want to do a little bit of background checking on them. You know, if you have access to any of the vetting platforms and can go and look at, even looking online at reviews of dealing with this broker.

Has anybody else dealt with this broker? Do they have some sort of a reputation, good or bad? Right. They may have a stellar reputation. That can also be a signal that you can use. Do they have a website? Does it match the email that they’re communicating with you using?

How long have they been in business? You know, is this a broker popped up last week or is this a broker that’s got an established, you know, they’ve been around for a number of years, have some history, but you always want to use more than one source. Right. You don’t want to just go to their website and say, okay, yeah, they’ve got a website.

Anybody with some AI tools can spin up a website in a few minutes. Now you want to use more than one factor. Just like we talk about multifactor authentication when it comes to accounts, you want to check multiple ways before you get into a business relationship with somebody.

[00:22:18] John Howland: Carriers. We have a solution at truckstop.com but yeah, totally agree with you. Awesome. Number two is if all the paperwork looks legitimate, including DOT, insurance, what else should drivers check before accepting a load? I know you kind of covered a little bit of that, but yeah.

[00:22:34] Benjamin Wilkens: So again, the paperwork can look correct, but it may not match everything that you can verify online. Right. So again, checking with fmcsa, running through some vetting platforms to make sure all of the information matches there. Sometimes you can communicate directly with a shipper, sometimes you can’t.

But that’s another way. If you’re able to communicate directly with the shippers and understand what they’re expecting you to pick up, you know, does it match legitimate looking paperwork.

[00:23:02] John Howland: Last one, which I’ve actually fallen a victim to this as well at times. It was really good and clever, to be honest with you. But what is advice you have for drivers, brokers who suspect that I just accidentally clicked on something and maybe they shared sensitive information with the scammer.

Like what is your advice for them and what they should do immediately afterwards.

[00:23:24] Benjamin Wilkens: Rotate passwords right away for your accounts. Change the passwords for any account that you use to receive that email in or entered credentials for. You know, sometimes you’ll have to sign in to, you know, let’s say you sign into a Microsoft account to get access to a document.

Change your password on that Microsoft account immediately. Make sure you have multi factor authentication set up and if you haven’t had it set up, get it set up right away on your accounts and then be aware that that information that you shared may be used fraudulently. Right.

So if it’s information about a shipment, reach out to the shipper, let them know, give them a heads up, hey, we need to have some preplanned extra checks at time of release for this shipment because there’s potential information on this load got leaked. So set that up in advance.

[00:24:08] John Howland: Great advice. All right, so we are coming to the end, which is probably my favorite segment, not because it’s ending, but because I get to ask some fun questions. So Ben, you’ve spent obviously seems like most of your career studying cybersecurity.

Now you’re now within the world of transportation, right? So if you could get every trucking business in America to adopt just one cybersecurity habit right now, what would that be?

[00:24:36] Benjamin Wilkens: Oh boy. Limiting me to one again, this is tough. But the very first one I always say is multifactor authentication. I say it frequently, I say it loudly. If everybody put multifactor authentication on every one of their accounts, it would be much, much harder to compromise the average trucking company than it is today.

If I had to pick a second, which I always like to add a second. Training we need to increase cybersecurity awareness training, phishing, resistance training. We see a lack of that as well, which is why these schemes work, right?

[00:25:08] John Howland: Yeah. Is there something that you or your organization does to help promote training and or awareness to cybersecurity?

[00:25:16] Benjamin Wilkens: That’s our core mission. So absolutely, we put out a lot of free resources to the industry. In fact, all of our cybersecurity guidebooks, best practices for everybody from owner operators all the way up through midsize large carriers. That’s all freely available.

And we pride ourselves in taking complex security language and translating it into trucking. So it’s not. You don’t need a cybersecurity degree to understand what’s going on in these guidebooks.

[00:25:41] John Howland: So how do carriers that are unfamiliar with it today, how do they get access to that? Where do they go?

[00:25:46] Benjamin Wilkens: NMFTA.org. And then there’s links right on that for all of our cybersecurity resources you can find freely download right there.

[00:25:54] John Howland: Awesome. Great. All right, here’s why this is my favorite segment. If animals could drive trucks and you were an animal, which animal would you be? And which animal do you think would be the best driver and why?

[00:26:08] Benjamin Wilkens: Oh, boy. So are these trucks equipped the same way they are now, or do we have, like, adaptive driving controls in here?

[00:26:15] John Howland: You know what? You can pick whatever you want.

[00:26:17] Benjamin Wilkens: Okay. Well, I think that if I was an animal trying to drive a truck, I’d want to be either a monkey or a gorilla or somebody with opposable thumbs, because I was a driver once upon a time, and I know those will help quite a bit. If animals could drive, which one would be the best at it?

You know, I think dogs probably have the most training miles. You see more dogs in trucks than you do any other animal. They don’t have thumbs. But if they could have the right equipment, I think they’d probably. You know, it’s like autonomous vehicles are being trained on road time. Right. We see a lot of dogs that have had training, so.

[00:26:47] John Howland: Great answer. All right, so who is someone in trucking doing great work that more people should follow or know about?

[00:26:54] Benjamin Wilkens: So I’m going to give you a group that I think is doing really good work. Obviously, shameless plug for NMFTA we’ve already had a chance to do, but I want to plug the Freight Fraud Prevention Hub, the partnership program that NMFTA did start, but has expanded.

There’s a lot of industry partners involved in that, and I think that it’s something that I want people to be aware of, because it’s not just talking about these issues. Like, we’ve all in the industry, we’ve known about some of these issues for a long time, and we’ve kind of talked our way around the problems a lot.

And the difference in Freight Fraud Prevention Hub is this partnership is focused on solutioning, whether it’s carriers, whether it’s brokers, whether it’s software vendors or platform offerings. There’s a lot of partnerships involved, bringing things to the table and bringing solutions and resources to fight freight fraud and cargo crime in our industry.

Freight fraudhub.com is a great resource. Again, free resources to the industry. I wish more people knew about it. We’re taking advantage of it.

[00:27:51] John Howland: That’s awesome. Well, Ben, that concludes it for today’s show. Really appreciate you being on a lot of great context. My summary is if it looks fishy, it probably is. Triple check things as you’re going through on your day to day.

It seems like people get a little bit more and more creative almost every single day with how they’re trying to steal identities, loads and those sorts of things. So just be on the lookout. Really appreciate Ben, you and your knowledge and your context here. I had fun. This is John with concluding Behind The Freight. Thank you guys.

[00:28:26] Benjamin Wilkens: Thanks for having me.

[00:28:28] John Howland: If today’s episode helped you think differently about your operation, share it with someone in your network who needs to hear it. And if you’re looking for tools to help keep your truck rolling from finding quality loads getting paid quicker, well, truckstop.com is here to help.

Go visit truckstop.com to explore the load board rate insights and risk management solutions built specifically for carriers and brokers. Thanks for listening to us at Behind The Freight. Until next time, keep the wheels turning and the bad loads burning.