The corridor, on the record.
What is being taken, by what method, where the pattern is moving, and what a person responsible for goods should do about it. Read daily from the public record, written for the people who have to decide something.
Reads: Verisk CargoNet quarterly and annual analyses · FBI, IC3 and HSI releases · New Jersey State Police and regional cargo-theft units · Federal and state court filings · The trade press of record
The record
Fewer thefts. Bigger ones.
Estimated losses, 2025
$725M
+60% on 2024
Supply-chain crime losses across the US and Canada. Incidents were flat; the losses were not.
Verisk CargoNet, Jan 2026
Average value per theft, 2025
$273,990
+36% on 2024
From $202,364 in 2024. Fewer opportunistic hits, more selective ones.
Verisk CargoNet, Jan 2026
Confirmed cargo thefts, 2025
2,646
+18% on 2024
Within 3,594 total events, essentially unchanged from 3,607 the year before.
Verisk CargoNet, Jan 2026
Q2 2026 losses
$304.6M
more than double Q2 2025
Against $135.7M a year earlier — while incident count fell 26%.
Verisk CargoNet, Q2 2026
First half of 2026
$359M+
average stolen value ~$341,518
Six months of 2026 already past half the whole of 2025, on fewer incidents. The average load taken is worth more every quarter.
Verisk CargoNet, H1 2026
Six quarters
Losses doubled on a falling count.
| Quarter | Est. losses | Losses against the largest quarter | Events |
|---|---|---|---|
| Q1 2025Losses stated as 'essentially unchanged' a year later at $131.58M | $131M* | 787 | |
| Q2 2025Q3 2025 was reported as a 10% decrease from Q2 | $135.7M | 858* | |
| Q3 2025Average value doubled to $336,787 | $111.9M | 772 | |
| Q4 2025Annual total less the three reported quarters; Q1 2026 was reported as a 12.2% decline from Q4 | $346M* | 874* | |
| Q1 2026596 confirmed thefts; about a quarter cyber-enabled | $131.6M | 767 | |
| Q2 2026Incidents down 26% year on year; losses more than doubled | $304.6M | 635* |
* Derived from two published figures — a total and a percentage change — rather than stated directly. Source: Verisk CargoNet quarterly analyses, Q1 2025 to Q2 2026, US and Canada.
Estimated losses, by quarter
$131M → $304.6M
Recorded events, by quarter
787 → 635
Read the two lines together. The count falls; the money rises. The thieves are not working harder. They are choosing better, and they are collecting on paperwork.
The method
Paperwork, not crowbars.
Fictitious pickups, Q2 2026
158
vs 165 a year earlier — flat
Total incidents fell 26% in the same quarter. Fences and patrols are working; verification at the gate is not.
Verisk CargoNet, Q2 2026
Cyber-enabled share, Q1 2026
~25%
About a quarter of all cargo-theft incidents were fictitious pickup or fraud — a document presented at a dock, not a lock broken.
Verisk CargoNet, Q1 2026
Average value, Q3 2025
$336,787
double Q3 2024's $168,448
Enterprise computing hardware, cryptocurrency-mining equipment and copper named as the targets.
Verisk CargoNet, Q3 2025
The way in
Business email compromise
Named as the primary access point for the sophisticated schemes: the shipment details, the contacts and the transport management system are reached through a mailbox, then the shipment is altered from inside and the impersonation looks legitimate at the gate.
Verisk CargoNet, 2026
What is being selected
Metals · enterprise components
Copper, molybdenum, antimony, tungsten and zinc; and on the technology side RAM modules, fibre-optic transceivers, storage drives and enterprise server blades. Small, dense, serial-numbered, and easy to move.
Verisk CargoNet, 2026
The consumer side
The checkout is the new dock.
Platforms that ship to consumers are worked the way freight is: identities borrowed, accounts taken over, cards tested, goods collected before the money comes back. The same method, at a smaller door.
Reported consumer losses, 2025
$15.9B
from $12.5B in 2024
Three million fraud reports. Imposter scams the most reported; investment scams the largest losses. A fraction of the real figure: most losses are never reported.
FTC Consumer Sentinel, 2026
Account takeover attempts
+78%
North America, Jan–Apr 2026
Driven by automated credential testing at scale. Overall fraud pressure on merchants up 33% in the same months.
Signifyd State of Fraud, Aug 2026
Card-testing attacks
+65%
North America, Jan–Apr 2026
Stolen card numbers checked with small charges before the real spend. Cheap AI tools make it fast; a platform's checkout is the test bench.
Signifyd State of Fraud, Aug 2026
The buyer's own fraud
36%
of fraud cases
First-party misuse: the buyer received the goods and disputes anyway. 64% of merchants report it rising, one in four by 25% or more.
Merchant Risk Council, 2026 Global eCommerce Payments and Fraud Report
AI-enabled complaints, 2025
22,364
nearly $893M lost
The first year the FBI counted them separately: voices, faces, documents and messages generated to deceive.
FBI IC3, Apr 2026
Crypto kiosk complaints, 2024
~11,000
about $247M lost
Mostly older adults told to turn cash into crypto. About twenty states now regulate the machines; three have banned them.
FBI IC3 via ABA Banking Journal
New Jersey
The corridor is the fastest-rising state.
New Jersey incidents, Q1 2026
59
from 27 a year earlier, +119%
The sharpest state increase in the quarter, continuing a trend first identified in Q3 2025.
Verisk CargoNet, Q1 2026
New Jersey, 2025 full year
+50%
Among the largest state increases of the year, with Indiana +30% and Pennsylvania +24% — the corridor and the warehouse belt behind it.
Verisk CargoNet, Jan 2026
Where the groups work from
NYC metro · California
Reduced activity from domestic groups in Texas and the Southeast; sustained or growing activity by organised groups with a nexus in the New York City area and California.
Verisk CargoNet, Q1 2026
Metals, Q2 2026
54 → 80
Metal-theft events in one quarter while nearly everything else fell; copper near record prices.
Verisk CargoNet, Q2 2026
The briefs
Our reports, one subject at a time.
A brief is a short written report on a single subject: a method, a corridor, a commodity. Every figure is dated and sourced. We publish one when there is something worth saying, not on a schedule.
This quarter
What the desk is watching.
What each practice is watching this quarter. Questions, not cases; read with the dated entries below.
Buy
- Who you are buying from Sellers and suppliers whose identity, registration and history do not hold up when checked, now that a storefront, an invoice or a certificate can be generated in minutes.
- What is being selected The goods thieves choose are the goods worth verifying on receipt: metals, enterprise components, small dense serial-numbered stock.
- Goods with a laundered history Stolen freight that passes through cross-docks gains a new bill of lading and a vaguer description at each hop. A price that is too good is a question.
Watch
- The gate Fictitious pickups held flat while every other method fell: the document presented at the dock is the weak point.
- Money in, goods out Deposits that become shipment requests within minutes, many cards on one account, high value to one door.
- Crypto kiosks and cash-out States are banning or capping crypto ATMs over scams aimed at older adults; withdrawals to new wallets are where stolen money leaves.
- Anything made by AI Fabricated IDs, documents, voices and storefronts. The check is no longer whether it looks right, but whether it holds up against the source.
Record
- Who can be sued Brokers can now be sued for negligently hiring the carrier. The record of how a carrier was checked is the defence.
- What wins a dispute Delivery proof, the signed release decision, matching prior orders. Evidence gathered before the sale, not rebuilt after it.
- What regulators ask for Kiosk rules now require fraud warnings, limits and screening; anti-money-laundering notices ask for the red flags to be documented.
Watch list
The public record, dated.
The desk reads the public record daily. This page is revised weekly, and on the day a quarterly report lands. Nothing member-only is republished; every entry carries its source.
-
Method
A $60,000 load of glycerin cloned and redirected to a cross-dock — stopped before it was unloaded
Seventy-five drums, 41,336 pounds, Hammond, Indiana to a suspected cross-docking operation in Thornton, Illinois. The criminals obtained the shipment details, built a document package that passed, altered the information in the transportation system and sent an unwitting driver to collect it. Cook County’s cargo-theft task force was tipped, read the carrier paperwork, tracked the truck and stopped it at the dock. Two things to notice: the method works on drums of glycerin, not only on electronics; and the fix the article names is a human verification step before the load moves.
-
Method
“Laundering freight” — the chair of TAPA Americas names the mechanism
Stolen goods pass through cross-docks and warehouses; each hop gets a new bill of lading and a vaguer description — a named product becomes “electronics” becomes “freight of all kinds”; bolt seals are swapped; a brand of headphones pinged in Europe a week after the theft. His proposed fix is an auditable record of every description change.
-
Enforcement
National Supply Chain Blitz: 24 hours, $635,000 recovered
Cook County Sheriff’s Police with the FBI, HSI, Illinois State Police, Chicago PD and the four Class I railroads. Thirty stolen transformers, about $600,000, located in Massachusetts. The method: a fraudulent bill of lading, then several cross-docks before anyone knew what was missing.
-
Method
Labor Day: $31.8M in thefts as criminals breach trusted freight accounts
Holiday-weekend losses tracked by CargoNet, with compromised accounts at legitimate brokers and carriers as the entry point — the identity is real; the person using it is not.
-
Data
Q2 2026: losses more than double to $304.6M while incidents fall 26%
Fictitious pickups essentially flat at 158. Metal-theft events rose from 54 to 80. Fewer thefts, much bigger ones — the pattern of the year.
-
Data
Signifyd: account takeover attempts up 78%, card testing up 65% in North America
Fraud pressure on merchants up 33% in the first four months of 2026, with automated credential testing and AI tools doing work that once took teams of specialists. The checkout and the login are now where the attack starts.
-
AML
Crypto kiosks: Minnesota's ban takes effect after Indiana and Tennessee
Indiana became the first state to ban crypto ATMs on 9 March 2026, Tennessee followed in July, and Minnesota's prohibition took effect in August. About twenty states have adopted rules: fraud warnings, daily limits, refund rights, blockchain screening, licensing. The driver is scams against older adults: in 2024 the IC3 logged nearly 11,000 kiosk complaints and about $247M in losses.
-
Scam
FTC: imposter scams the most reported fraud for a fifth straight year, $3.5B lost
Part of a record $15.9B in reported consumer losses for 2025, from three million reports. Bank transfers and cryptocurrency remain the payment methods with the largest losses.
-
Data
County-level theft risk ratings reach the cab
Verisk CargoNet theft data was integrated into Trucker Path navigation: county-level risk ratings, monthly stolen-vehicle counts, the commonly targeted commodities and the common theft subtypes, surfaced to a driver choosing where to stop. Worth noting for what it is and is not. It helps a driver avoid a parking lot. It does not tell a dock who is standing in front of it.
-
Enforcement
Eight indicted in Manhattan over a $5M carrier-impersonation ring working the corridor
The Manhattan District Attorney announced an indictment of eight people over an organised, multi-state operation that took close to $5 million in goods from logistics sites in Pennsylvania, Virginia and New Jersey, then moved them into New York City for sale. Six thefts: $165,000 of lamb, $432,000 of cheese, $295,000 of beef, more than $266,000 of copper, and more than $3.3 million of cigarettes. The method is the one that matters here. Winning bid information came from hacker groups; the defendants leased tractors, affixed the name and registration number of the carrier that was actually supposed to collect, drove to the logistics centre, and were handed the freight. Verisk CargoNet analysts worked with investigators on the pattern. Nothing was broken into, and the commodity list is food and cigarettes, not electronics.
-
Data
Freight Fraud Symposium: deepfakes, double brokering and identity theft
The industry’s own event, held in Cleveland, put AI-assisted impersonation, double brokering and identity theft at the centre of the agenda.
FreightWaves
-
Law
FMCSA adds identity proofing at registration, and the attack moves downstream
FMCSA’s new Motus registration system brings identity proofing to new carrier and broker applications. Read it alongside the impersonation cases: if the regulator now checks identity when an authority is issued, the remaining soft point is the moment a real, properly registered authority is impersonated at someone else’s dock. Registration is not the gate. The gate is the gate.
-
Law
Supreme Court: a broker can be sued for negligent hiring of the carrier
Montgomery v. Caribe Transport II. Federal preemption no longer shields the broker who booked the fake carrier.
-
Method
IC3 public service announcement: cyber-enabled strategic cargo theft surging
The FBI’s Internet Crime Complaint Center describes the hybrid crime — phished broker mailboxes, cloned carrier identities, loads collected on paperwork that passes every check — and asks victims to report it as cyber.
-
Data
Q1 2026: incident volume falls; New Jersey more than doubles
767 events, down 5.3% on the year. Losses flat at $131.58M. New Jersey from 27 to 59 incidents. About a quarter of incidents cyber-enabled. Organised groups with a New York City and California nexus sustain or grow while domestic groups elsewhere recede.
-
Scam
IC3 2025: $20.9B in reported losses, about half tied to cryptocurrency, and a first section on AI
Losses up 26% on 2024, the highest in the report's history, on more than a million complaints. More than $11B tied to cryptocurrency; investment fraud $8.6B; business email compromise about $3B. For the first time the report counts AI-enabled complaints: 22,364, costing nearly $893M.
-
Data
2025 in full: $725M in losses, up 60%, on a flat incident count
Confirmed thefts up 18% to 2,646; average value up 36% to $273,990. New Jersey +50%, Indiana +30%, Pennsylvania +24%. Food and beverage +47%; metals +77%.
-
Method
A fictitious pickup takes $400,000 of lobster from a freight broker
The load was collected by a carrier that was not the carrier booked. A clean example of the method at the scale most thefts actually happen.
-
Data
Q3 2025: average value per theft doubles to $336,787
772 events, flat on the year. Enterprise computing hardware, cryptocurrency-mining equipment and copper named as the targets of organised groups. The New Jersey trend first identified here.
-
AML
FinCEN: crypto kiosks used for scam payments and other illicit activity
FIN-2025-NTC1 warns that kiosks are used in fraud, cybercrime and drug-trafficking activity, with a rise in tech-support and bank-impersonation scams, and gives the red flags institutions are expected to document. It adds no new obligation; it raises the stakes of missing one.
-
Corridor
“Cargo thieves are attacking the U.S. supply chain at alarming rates”
National coverage of the shift from parking-lot theft to organised, document-driven collection — the moment the method became a mainstream story.
-
Data
Q1 2025: 787 incidents, down 7% on the year
A continued decline in count, with targeting shifting toward essential goods and raw materials — the beginning of the fewer-but-bigger pattern.
The desk
What we do with it.
Read
The public record, daily: reports, releases, indictments, filings, the trade press. Nothing member-only is ever republished.
Pattern
What was taken, from where, by what method, and what the sequence says about the next quarter. Pattern level, never a person.
Brief
A short written report on one subject, dated and sourced. Subscribers get it by email first; it is published here after.
Apply
The same reading feeds the record we keep for owners: which lanes, which commodities, which documents to distrust this month.
Findings are at pattern level — a method, a corridor, a commodity — never a person, never a client, never a lane of ours. The same reading feeds the record we keep for owners: which documents to distrust this month, and at which gate.
Decisions on things and transactions, never on people.
The list
Get each brief by email.
We email you each brief when it is published, and nothing else. We never share your address. Email inquiries@bsjventures.com with the word “subscribe.”
A brief written to your operation?
Commissioned briefs, written to your operation, your lanes and your categories, are engaged through BSJ Ventures. We answer within a business day.
Or write to inquiries@bsjventures.com.