-
Field note 01 · Payments
Each order passes. The set does not.
Coordinated fraud is built to pass the check in front of it. Card testing and account takeover are both up sharply this year in North America, by the merchant side’s own count. Each order in a coordinated run can look ordinary on its own. Checked one order at a time, every order verifies. Read as a set, they do not.
What we do about it. Read orders as a set, not one at a time. Hold the set, not the single order, and name for each account the record that would verify it.
-
Field note 02 · Cargo
The identity is real. The person using it is not.
Holiday-weekend cargo losses this year came in through compromised accounts at legitimate brokers and carriers. In the Manhattan impersonation case, the defendants leased tractors, put on the name and registration of the carrier that was actually booked, and were handed the freight. Nothing was broken into. Registration now carries identity proofing, so the soft point has moved to the moment a real authority is impersonated at someone else’s dock.
What we do about it. Verify at release, not at onboarding: the carrier, the driver and the equipment checked against the tender through a second channel, and the pickup number released only on GO.
-
Field note 03 · Cargo
Fewer thefts, bigger ones.
Reported cargo losses in 2025 rose 60 percent on a flat count of incidents. In the second quarter of 2026, losses more than doubled while incidents fell by about a quarter. The method has not changed; the targets have. Organised groups take fewer loads and better ones.
What we do about it. Spend review where the value is. What the client’s rules mark as high value waits for review; the rest releases under the client’s written rules. We are paid per order reviewed, never by the value of what ships.
-
Field note 04 · Cargo
Freight is laundered one description at a time.
The chair of TAPA Americas describes stolen loads re-papered at each cross-dock: a named product becomes “electronics”, then “freight of all kinds”, and the seals change on the way. A cloned load of glycerin in Illinois was stopped at the dock because someone read the carrier paperwork and checked it before anything was unloaded.
What we do about it. Keep every description change on the record, append-only and dated, so the chain can be read backward. Put the human verification step before the load moves, not after.
-
Field note 05 · Sanctions and trade controls
A screen that lags is a gap.
OFAC’s late-September action named crypto deposit addresses at exchanges; a screen a day behind the list lets them through. FinCEN’s action against the A7 network’s sub-agents rests on a list that is confidential and shared only through secure portals, so no public-list screen will catch it.
What we do about it. Ask where each list comes from and how fresh it is. Record the list version beside every screened decision, and treat “not on the public list” as a gap to close, not a pass.
-
Field note 06 · Crypto
Freezes after the fact recover almost nothing.
September was the worst month of the year for crypto thefts. After the largest, attributed to North Korea, the exchange froze $1.1 million of the $387 million taken. The money moved first; the decision came second.
What we do about it. Put the decision before the transaction. A payout, a withdrawal or a change of bank details waits for verification through a second channel, and the verification goes on the record.
-
Field note 07 · Payments
Kiosk cash is where the rules are going.
Indiana banned crypto kiosks in March, Tennessee and Vermont in July and Minnesota in August. On 1 October Hawaii barred kiosks from taking US dollars for crypto, by cash or card, Alabama added limits and refunds, and Maryland pulled software operators into registration. FinCEN has already listed the red flags it expects institutions to document.
What we do about it. For platforms that hold balances: write FinCEN’s red flags into the program’s rules and keep the file the program points to. The compliance officer decides and files; we never do.
ABA Banking Journal · FinCEN · Hawaii News Now · Hawaii HB 1642 · Vermont H.648 · The state rules · Last checked 13 October 2026
-
Field note 08 · Cargo
Do not let the outside say what is inside.
Two branded trailers were stolen from a California lot this month; one held twenty thousand pounds of sand. Crews choose targets by what the outside of the trailer, the carton or the dock tells them.
What we do about it. Nothing in a high-value lane should be readable from outside: plain cartons, plain trailers, and seal numbers on the record rather than on a label.
-
Field note 09 · Equipment and infrastructure
The controllers nobody listed.
Overnight on 11–12 October, refrigeration at hundreds of French supermarkets was forced into defrost through remote controllers; France’s CERT-FR warned against controllers reachable from the internet, and the maker said most were past their update life.
What we do about it. Keep an inventory of every controller by make, model and firmware, replace what can no longer be updated, keep management interfaces off the internet, and read the advisories for what you run.
Read the note · CERT-FR · CNBC
-
Field note 10 · Supply chain
A drone is a flying supply chain.
The acting Army secretary said on 12 October that if somebody else controls one part, they can break the whole thing, and announced a manufacturing rodeo to find where the industrial base breaks.
What we do about it. Check who produced the parts, not whose name is on the box, against the Covered List, Section 889 and the 1260H list, and keep the dated record.
-
Field note 11 · Gaming
The money leaves at the withdrawal.
Pennsylvania’s regulator fined two online operators in 2026 over weak know-your-customer controls, one of which it said led to fraudulent withdrawals; New Jersey’s says withdrawals need not be instant when a fraud check is needed.
What we do about it. Read withdrawals in context, not one account at a time; hold the release for review; a named reviewer decides; the record is append-only.
Read the note · PGCB · NJ DGE
-
Field note 12 · Gaming
The safe harbour has ended.
Pennsylvania’s Supreme Court held on 15 June that skill games fall under the Gaming Act and the Crimes Code and gave 120 days of safe harbour; it ended on 13 October, and the Attorney General and the State Police say enforcement may begin on 14 October.
What we do about it. We do not advise machine owners; we point them to the official guidance and their own counsel. For licensed operators, we watch where the money goes next: new accounts and withdrawals.
-
Field note 13 · Security
The invite that skips the inbox.
Fake voicemail and document notices are being sent as calendar invites, which can land in the calendar even when the email is filtered, and often come from a real but compromised account.
What we do about it. Do not click, accept or decline; report it as phishing and delete it; tell the sending organisation through its published contact. Admins: limit automatic invitations and require phishing-resistant sign-in.
Read the note · Google · CISA
Field notes are written by the desk from public sources. The method behind them is published at how we decide. Engagements, memberships and invoices are BSJ Ventures LLC’s.
Ask about membership