5 phishing emails hitting dispatch desks right now in 2026 - and how to spot them.
Attackers are sending highly targeted phishing emails to US trucking dispatch teams in 2026. Here are the 5 most common patterns, annotated examples, and a printable red-flag checklist to share with your team Monday morning.
Want this handled for you? See our 24/7 monitoring for carriers.
These aren't hypothetical. In 2025 and 2026, attackers sent highly targeted phishing emails to US trucking dispatch teams - compromising broker accounts and installing remote access tools, while cargo theft losses in the US and Canada reached nearly $725 million in 2025 (Verisk CargoNet). Here are the 5 patterns, with annotated examples and a checklist to share with your team.
Why your dispatch desk is the primary target
Dispatchers are the keys to the kingdom. They have credentials for load boards, TMS platforms, and broker communication channels. They handle high-volume email under time pressure - dozens of load requests, check calls, and rate confirmations every hour. And many get no security training specific to trucking threats.
Proofpoint researchers in late 2025 documented organized crime groups running coordinated remote access campaigns specifically targeting trucking and logistics dispatch teams - not because they wanted to steal data, but because controlling a dispatcher's account meant controlling physical freight worth hundreds of thousands of dollars per load.
The 'fake broker rate confirmation'
The attacker spoofs a real broker's email domain - often a lookalike with a small change (e.g. brokername.com β brokername-rates.com). The email looks exactly like a normal rate confirmation but contains a link to 'view the rate sheet' that installs an RMM tool.
Hi team,
Please find the updated rate confirmation for Load #8841 attached. The shipper has requested an amended delivery window - please review and confirm by 3PM.
π View Rate Sheet β brokername-rates.com/rc/8841.pdf
Questions? Call your rep at (312) 555-0192.
Thanks, Carrier Relations | [Broker Name]
The 'carrier packet request' from a new shipper
Targets owner-operators and small carriers hungry for new business. The attacker poses as a shipper or broker onboarding the carrier and sends a 'carrier packet' PDF or link that installs malware - then uses the harvested MC number and insurance certificates to impersonate the carrier on load boards.
Hi,
We found your carrier profile on DAT and we'd love to add you to our preferred carrier network. We have consistent dry van lanes out of Atlanta - 3β5 loads/week.
To get started, please complete our carrier packet:
π Complete Carrier Packet β carrier-setup.freightpartnersinc.net/onboard
Takes about 10 minutes. Once approved you'll receive loads directly from our team.
Best, Sarah Walsh | Carrier Development
The 'ELD compliance update' from 'FMCSA'
Attackers know carriers are terrified of FMCSA violations. This email spoofs official government communications - warning of a compliance issue with your ELD or DOT number and demanding immediate action through a link that installs malware.
FEDERAL MOTOR CARRIER SAFETY ADMINISTRATION - NOTICE OF COMPLIANCE REVIEW
Your USDOT record indicates a potential ELD reporting discrepancy. To avoid a compliance hold on your operating authority, you must complete a verification form within 72 hours.
π Complete Verification β fmcsa-updates.gov.us.com/compliance/verify
Failure to respond may result in suspension of operating authority.
FMCSA Compliance Division
The 'lumper / detention invoice' malware attachment
A simple but effective attack targeting accounting. The attacker sends a realistic-looking detention or lumper invoice as a Word document or Excel file. Opening it executes a macro that installs malware. This attack specifically targets firms that use older Microsoft Office versions without Protected View enabled.
Hello Accounts Payable,
Please find attached the detention invoice for delivery on 06/03 at the Chicago facility. Total owed: $380.00.
π Detention_Invoice_2847.xlsm β (malicious macro-enabled Excel file)
Please remit payment within 30 days. Thank you for your business.
Premier Lumper Services
The 'fuel card update' account takeover
Targets fleet managers and operations leads. The attacker spoofs a fuel card provider (EFS, Comdata, Relay) and claims the account requires re-verification due to a 'security review.' The goal: steal credentials and drain the fleet's fuel card balance, or use account access to harvest driver data for identity theft.
Dear Fleet Manager,
As part of our ongoing security upgrades, we require all account holders to verify their credentials by June 20. Failure to verify will result in a temporary account hold.
π Verify My EFS Account β efs-fleetsupport.com/verify/secure
This takes less than 2 minutes. Your drivers will not be affected during business hours.
EFS Security Team
Two more patterns worth a mention
The 'driver resume' targets recruiting inboxes: a .htm or .zip file that looks like a CDL application and opens a credential harvester branded with your own logo. Route all resumes through your ATS, never direct email. And the most expensive one of all: the factoring change request, where an attacker emails your customer pretending to be you and asks them to redirect ACH payments to a new account. By the time you notice, weeks of invoices are gone. The fix is a bank-change verification policy on both sides and DMARC enforcement on your domain.
Load board password resets and card number requests
Two smaller lures show up often enough to train for. The first is a "your DAT or Truckstop password expires in 24 hours" email from a lookalike domain. Put MFA on every load board and write down one rule: password resets never come through an email link. The second spoofs Comdata, EFS or WEX and asks the dispatcher to "verify the last 4" of card numbers. Always call back on a number you already have.
The printable red-flag checklist for your team
Print this. Post it at every dispatch station. Go through it with new hires during onboarding. Check every unexpected email against this list before clicking any link or opening any attachment.
- β Does the sender domain exactly match the company's real website? (e.g. brokername.com, not brokername-rates.com)
- β Is there a link asking you to 'view a document' on an external website rather than a direct attachment?
- β Is there artificial urgency - a deadline, account-suspension threat, or 'immediate action required'?
- β Is the attachment a .xlsm, .docm, .exe, or .zip file you weren't expecting?
- β Is this from a government agency (FMCSA, DOT, USDOT) via email with a link? Check any notice by logging in to FMCSA directly, never through the link.
- β Is someone you've never worked with offering new loads, rates, or partnerships via a cold email with a link?
- β Does the email ask you to update login credentials, re-enter payment info, or confirm insurance details through a link?
- β When in doubt - call the sender directly using a number from their real website, not the number in the email.
What to do if you clicked
- Disconnect the machine from the network (unplug ethernet, disable Wi-Fi).
- Leave it running - do NOT turn it off, forensics need the memory state.
- Call your IT contact or SOC immediately.
- Change all passwords for load boards, TMS, and email from a different device.
- Notify your broker contacts that your account may be compromised.
- Check FMCSA records for any unauthorized changes.
- Try to clean up the machine yourself before IT or your SOC has looked at it.
- Pay any ransom before consulting a professional.
- Wait to see 'if anything happens' - attackers count on the delay.
- Tell only one person - escalate to ownership immediately.
- Continue dispatching on the compromised machine.
The technical layer that stops these attacks before they arrive
Human training matters - but humans make mistakes under pressure. The second line of defense is technical. Trucky's cybersecurity partnership with We Secure deploys three layers that stop these 5 attack patterns before the email ever reaches a dispatcher:
- β Email security with link sandboxing - every inbound link is detonated in a sandbox before delivery. Malicious links are stripped automatically.
- β Anti-spoofing (DMARC / DKIM / SPF enforcement) - emails spoofing your domain or your brokers' domains are blocked at the gateway, not just flagged.
- β EDR with behavioral detection - if a dispatcher does click, EDR can flag and block an unexpected remote access tool, and a 24/7 SOC can isolate the machine before the attacker uses it.
Protect the systems your operation depends on.
We cover assessments, 24/7 monitoring, phishing defense and incident response. Everything is set up around ELDs, dispatch, telematics and vendor systems.