Look-alike domains in freight: how double brokering starts

A carrier’s or broker’s name, MC number and insurance details are public. A domain one letter off theirs costs a few dollars and a few minutes. Put the two together and someone can book a load as a company they are not. That is how a lot of double brokering starts.

What a look-alike looks like

Say the real company emails from examplefreight.com. Every one of these reads the same at a glance:

Invented examples. Some look-alikes also use characters from other alphabets that look identical to Latin letters.

Look-alike domains can send email that passes every technical check, because that domain really did send it. Spam filters are not built to know which freight company you meant to deal with.

How it turns into double brokering

The pattern varies, but it usually runs like this:

1. A real identity is picked. An active carrier with a clean record, found on the public FMCSA record or a load board.
2. A contact is attached to it. A look-alike of the carrier’s domain, or a free mailbox with the carrier’s name, and a phone number the impersonator answers.
3. A broker is set up. The real carrier’s MC, W-9 and insurance certificate go to the broker from the new address, often copied from paperwork the carrier sent out before.
4. The load is booked to what the broker believes is that carrier.
5. The load is re-brokered. It is posted again, often under another borrowed name, and a different, real carrier hauls it.
6. The money goes the wrong way. The broker pays the bank details on the borrowed packet. The carrier that hauled the load is not paid, and the carrier whose name was used hears about it when someone calls them.

The same trick works pointed the other way: a look-alike of a broker’s domain, used to book carriers on loads the broker never posted. How broker impersonation works.

Checks for brokers booking a carrier

• Compare the domain with the carrier’s website and with email you know came from them. Read it letter by letter.
• Check how old the domain is. Any WHOIS or RDAP lookup shows the registration date. A domain a few weeks old sending you an established carrier’s packet is a question worth asking.
• Call the number on the FMCSA record, not the one in the email, and confirm the person booking really works there.
• Notice recent record changes. A carrier whose phone or email on file changed just before it started booking with you deserves that call even more.
• Match the money to the name. The bank account or factoring company should belong to the carrier on the MC, not to a third name.

Checks for carriers protecting their own name

• Know your own domain, and consider registering the obvious variants of it before someone else does.
• Use two-step sign-in on your email and on every portal that can change your FMCSA record or your payments.
• Check your FMCSA record now and then for changes you didn’t make.
• Tell your brokers how changes will come: for example, only by phone from the number they already have.
• A broker calling about a load you never booked is the sign your identity is in use. Act that day. What to do in the first hour.

Where LaneScout fits

Mail Guard checks every new email in every mailbox your company protects. It compares each sender with the domains your company already deals with, with broker domains on the FMCSA record, with load platforms and with your own domain, and labels the near-copies in Gmail with a note on what to check. It also warns when your packet, W-9 or insurance certificate is about to go to a domain your company has never written to before.

On the DAT One board, the free LaneScout extension shows how new a posting’s email domain is, right on the row.

Google Workspace and Gmail today; Microsoft 365 in early access. Nothing to install, no card for the trial. Every setup step.