Cybersecurity Checklist for Carriers

Not too long ago, the biggest security concern for your trucking business was physical theft—protecting your cargo, equipment, or even the items inside your cab from being stolen.

While those types of crimes still occur, cybercrime is what’s plaguing today’s carriers. For truckers, cyberattacks can result in stolen payments, hijacked accounts, and disrupted operations.

Cybercrime, one of the fastest-growing threats globally, impacts businesses of all types and sizes, including freight carriers and independent owner-operators. And falling victim to these scams can cost you significantly. In fact, in 2023, data breaches in the U.S. cost businesses an average of $9.48 million per incident.

Protecting your business from these risks has never been more important. The good news? You don’t need a big IT team or a hefty budget to start boosting your cybersecurity. Implementing a few practical steps can go a long way in keeping your systems secure and your operations on track.

Understanding cyber threats in the freight industry

With so many devices required to connect with freight partners, manage loads, and move freight efficiently, the freight industry has become an appealing target for hackers. Cybercriminals hack into systems to steal identities, intercept payments, and gain access to your private data for malicious purposes.

Why the freight industry is targeted

The freight industry is particularly vulnerable to these types of fraud for two reasons.

1. Big Payouts: These scams can be very profitable for criminals. If they can steal login information from carriers, brokers, or shippers, they can impersonate legitimate companies and steal payments made during transactions.
2. Fast-Paced Communication: Freight involves a lot of communication via email and text messages. This includes everything from updates on shipments to price negotiations and payments. People in the freight industry are used to this constant communication, which can make them more susceptible to clicking on malicious links or giving away information in phishing attempts. If you’re not careful, you can unsuspectingly click on a link or divulge information that could lead to an attack.

Types of cyber scams

Cybercriminals use various scams to gain access to your accounts or information. Here’s a breakdown of the most common ones:

Phishing

Over 90% of cyber attacks start with phishing. Cybercriminals use email to trick you into revealing sensitive information. These emails can be incredibly convincing, often appearing to come from a familiar website, a trusted company, a coworker, or even your boss. The key to not falling for these scams is education. By understanding their tactics, you can respond with caution and protect yourself from becoming a victim.

In phishing emails, the cybercriminal might ask for the following:

• Date of birth
• Social Security number
• Phone number
• Home address
• Credit card details
• Log in details
• Passwords or other information to reset a password

The information can be used to impersonate you, allowing scammers to apply for credit cards or loans, open a bank account, log into your load board account, or commit another cybercrime.

Phishing happens when a victim acts on a fraudulent email that requires urgent action and/or asks you to do something, including:

• Click an attachment.
• Update a password.
• Respond to a contact request via social media.
• Connect to a new Wi-Fi hotspot.

Smishing

Cybercriminals are increasingly turning to text-based scams, or smishing, to reach drivers directly on their phones. These messages look urgent and are designed to trick you into sharing sensitive information, clicking on a link, or downloading harmful software. Just like email-based phishing attacks, these messages appear to be from trusted sources, and they create a sense of urgency, curiosity, or fear to manipulate users into taking an undesired action.

An example of smishing might be a text message alerting you of a suspicious transaction, urging you to take some sort of action like verifying your account.

Other common tactics include:

• Tech support scams – Users get a message warning them about a problem with their device or account requesting they contact a tech support number. Calling this number can lead to charges, or the “technician” might request remote access to the device, leading to data theft.
• Service cancellation alerts—The fraudster warns the victim that a subscription or service is about to be canceled due to a payment issue. The recipient is urged to click on a link to “resolve” the issue, which usually leads to a phishing page.
• Malicious app downloads – Scammers might send a text message promoting a supposedly useful or entertaining app. Clicking the download link in the message installs malicious software on your device.

How to identify suspicious messages

While it can be difficult to tell a legitimate message from a scam, there are signs that should alert you that a message may be fraudulent.

If an email or text seems suspicious, do the following to confirm legitimacy:

1. Hover over the email link to see if it reveals anything unusual. If it seems irregular or points you to a site that you’re not familiar with, beware and err on the side of caution by not clicking on the link.
2. Be suspicious if a message asks for personal information from you. Unknown sources that demand your personal information, passwords, or payment information should always be investigated with caution. If the message creates a sense of urgency or fear, it’s best to do your due diligence.
3. Watch for grammatical errors. Phishing and smishing messages often contain misspelled words or language irregularities, signaling that they originate from bad actors in other countries.

Quishing

QR code phishing, or “quishing,” is a scam where fake QR codes are used to trick people into visiting dangerous websites or downloading harmful software. Since QR codes are widely used for things like menus, payments, and logins, they’ve become popular for cybercriminals to exploit. Attackers often embed these malicious QR codes in unexpected places, such as emails from trusted sources or public advertisements.

When unsuspecting victims scan these fake codes, they’re often redirected to phishing websites designed to steal sensitive information like passwords and credit card details. These scams are particularly effective because they can bypass traditional email filters and security software, making them a growing threat to cybersecurity.

Common quishing tactics include:

• Fake payments: Scammers use QR codes on parking tickets or invoices, leading to fraudulent payment sites.
• Identity theft: Quishing can redirect users to fake login pages to steal sensitive information like usernames and passwords.
• Malware distribution: Some QR codes automatically download harmful software onto devices.

Signs of quishing attacks

• Unexpected emails: Be wary of emails with QR codes from unknown sources.
• Unusual requests: Avoid urgent requests to scan QR codes.
• Altered codes: Inspect physical QR codes for signs of tampering.

To protect yourself from quishing, it is important to be aware of the risks and take steps to avoid becoming a victim. Here are some ways to verify a code before scanning.

• Check the QR source: Only scan codes from trusted sources and verified email addresses.
• Inspect URLs: Check the URL after scanning a code but before clicking on the link.

Red flags in emails and texts

• Unusual content. Be wary of any emails or text messages that seem out of place, irrelevant to you or your business, unexpected, or unsolicited.
• Unknown senders. Phishing and smishing messages tend to come from unknown senders, although scammers are skilled at making the email look like it came from a legitimate source. Be cautious of messages from people or addresses you don’t recognize.
• Strange requests. Be suspicious if a message offers something unexpected or seems demanding.
• Requests for personal information. Always be skeptical of a message that asks you to provide sensitive information, like your social security number, account numbers, or passwords.
• Sense of urgency or fear. If a business or professional message provokes fear or urgency, don’t fall for it, especially if it comes from an unknown source.
• Suspicious links. Validate authenticity before clicking on any links.

Protecting yourself and your business

Phishing and smishing scams are a constant threat to freight professionals, but by following security best practices, you can significantly reduce your risk of falling victim.

Cybersecurity best practices

• Verify the sender’s identity before clicking links or opening attachments. Inspect the “from” address carefully for discrepancies or irregularities.
• Be cautious of unsolicited offers or prize notifications.
• Never share sensitive information through email or text.
• Report suspicious messages to your IT department or relevant authorities.
• Use strong, unique passwords for each login. Don’t include personal information like your name, birthdate, or family details as this could be easy for scammers to guess.
• When possible, use multi-factor authentication (MFA) and enhanced security tools available to you.
• Validate the domain authenticity before clicking on any links or entering personal credentials. (For example, confirm you are visiting Truckstop.com and NOT info-truckstop.com or Truckstop.blog.)

What to do if you get hacked or identify a scam

If you suspect a cybercrime, report it to the Internet Crime Complaint Center, or IC3, the central hub for reporting these types of scams. It’s monitored by the FBI and contains educational resources on the latest and most threatening cyber scams. If you suspect a security breach on the Truckstop platform, email [email protected] to report fraudulent activity.

ELD hacking

Another point of security vulnerability occurs with the use of federally mandated electronic logging devices used to log your hours of service. Off-the-shelf electronic logging devices (ELDs) can be very limited in terms of the security they can provide and can be a vulnerability with dire consequences.

Researchers have identified cybersecurity gaps in popular ELDs, determining they could potentially be accessed using Wi-Fi or Bluetooth to disrupt a truck’s operation. Simply put, cyberattacks can be made by hacking into a truck’s system via an unsecured ELD in seconds while driving alongside it.

In fact, malware on one truck could spread to other trucks while traveling on a highway or waiting at a distribution center, truck stop, rest stop, or other location, creating “truck-to- truck worms,” wireless cyberattacks designed to infiltrate entire fleets and cause major disruptions, including sending malware that causes trucks to behave in unexpected, unwanted, and dangerous ways.

Researchers found they not only could access a truck’s accelerator pedal by simply driving by it, but it could also infect a fleet of trucks with malicious malware by hacking into just one ELD.

It’s critical for smaller trucking companies and owner-operators to have a good understanding of common ELD vulnerabilities and to pay attention to any suspicious activity, no matter how small it seems.

At the very least, consider where the vulnerabilities are and consult with technology experts about how to block holes in security:

How to secure your truck against ELD vulnerabilities

• Keep your ELD updated. ELDs may require periodic security updates that include patches for newly discovered vulnerabilities.
• Don’t use weak default passwords. Change your password to a stronger one, the longer, the better. Use random letters and characters, like a string of mixed-case letters, numbers and symbols, or a passphrase of 4 – 7 random words.
• Avoid exposed public Wi-Fi and Bluetooth connections.
• Avoid vulnerable firmware: Some ELDs have insecure firmware that can be easily reverse-engineered and modified by attackers.
• Keep your business software updated. Defects in software and apps can give criminals an opening.
• Utilize multi-factor authentication. Use a texted code, authenticator app, or biometrics in addition to your password.

Carrier cybersecurity checklist

• Check for misspelled email addresses or domain names.
• Be wary of messages creating a sense of fear or urgency.
• Be cautious of unsolicited offers.
• Look for grammatical errors, misspellings, and language irregularities.
• Verify unexpected requests for sensitive information.
• Hover over links and be cautious with unsolicited attachments and links.
• Verify the legitimacy of tech support requests.
• Be cautious of requests to download apps via text message.
• Look for threats or warnings of account closures.
• Keep software updated.
• Avoid public wi-fi.
• Choose ELDs with enhanced security features or add security features.
• Use multi-factor authentication in addition to your passwords.
• Never use weak default passwords. Create strong, unique passwords for all devices and systems.