How to spot a fake broker email before you reply

Plenty of freight fraud never touches the load board. It arrives as an email that looks like it came from a broker you know: a rate con, a setup request, a new bank account, a notice from “FMCSA.” Here is what to look for, and the one check that settles it.

The two-minute check

The phone number, the link and the “call me back” in a doubtful email all go to whoever sent it. The record and your own file do not. How to read the FMCSA record in a minute.

Seven signs worth stopping for

None of these proves anything alone. Two together is a reason to make the call before you reply.

1. The name is right, the address is not

Anyone can type a broker’s name into the “From” name. Open the sender and read the actual address. A broker that runs its email on its own company domain does not usually book loads from a free consumer mailbox.

2. The domain is almost right

One letter added or swapped, rn where an m should be, a zero for an “o”, an extra word or hyphen, .co or .net instead of .com. Read fast on a phone, it passes. How look-alike domains are built, and what they lead to.

3. Replies go somewhere else

An email can come from one address and send your reply to another. Press reply and read the “To” line before you type. If it is not the address the email came from, stop.

4. It wants to move off email

“Text me on this cell.” “Our office line is down, use WhatsApp.” A new number in the signature that you have never called. Moving you to a channel nobody else at your company can see is the point.

5. It asks about money or documents

New bank details, a remit-to change, a factoring notice, a quick-pay or setup fee, or your packet, W-9 and insurance certificate “to update our file.” This is where the loss happens, so it is where the call matters most. The payment-change checklist.

6. The link or the attachment is wrong

A “view your rate con” link that opens a sign-in page. An attachment that is an .html page, a .zip, or a password-protected file instead of a PDF. A PDF that asks you to sign in to read it. A real rate con is a document, not a log-in.

7. The MC and the contact don’t line up

The signature cites an MC, but the company on that MC has a different phone, a different domain or a different name. Impersonation borrows a real MC and attaches a contact the sender controls. The MC survives a lookup. The contact does not.

Emails that say they are from FMCSA

Fake FMCSA notices are a common way to steal the sign-in to a carrier’s or broker’s FMCSA account. They usually threaten something on a deadline: an authority “deactivated within 24 hours,” an MCS-150 “overdue,” a “compliance review.”

• Read the address, not the name. “FMCSA Compliance Unit” is just text anyone can type. Real FMCSA email comes from a .gov address.
• Don’t sign in from a link, even a real-looking one. Type the FMCSA address into the browser yourself and check your account there.
• Be careful with “compliance services” that write as if they were FMCSA and ask for a fee or your login.

When the address really is the broker’s

Sometimes every technical detail is right because the email really did come from the broker’s mailbox: someone took the mailbox over. This is business email compromise, and it is the hardest kind to spot by reading. The tells are in the request, not the address: a payment change out of nowhere, a new contact joining the thread, a reply-to that changed mid-conversation, a tone that doesn’t sound like the person.

The defence is the same call, to a number you already had. A taken-over mailbox can write anything; it cannot answer the broker’s office phone.

What to do with one you doubt

1. Don’t reply, don’t click, don’t open the attachment.
2. Call the broker at the number on the record or in your file and ask.
3. If it is fake, tell the real broker. Their name is being used and they want to know.
4. Warn your team. The same email often goes to several people at once.
5. Already sent a packet or signed in? Here is what to do in the next hour. If money moved, call your bank first, then report it at ic3.gov.

Where Mail Guard fits

Checking every email by hand doesn’t survive a busy Tuesday. LaneScout Mail Guard checks every new email in every mailbox your company protects, for the signs on this page: impersonated brokers and carriers, look-alike and new domains, reply-to changes, payment requests, fake FMCSA notices, sign-in links and disguised attachments.

• A label in Gmail, Verify first or Worth verifying, and a short note saying what to check.
• Your team answers “genuine” or “not genuine” once, and every copy of that email updates.
• It never sends, deletes or moves email. It does not replace the phone call. It tells you when to make it.

Google Workspace and Gmail today; Microsoft 365 in early access. Nothing to install, no card for the trial. Every setup step.