The Bank Change Request Is the Theft: Carrier Payment Controls Before Year-End 2026

The email looks routine. A carrier you have paid forty times says it switched banks and attaches a voided check on its letterhead. It comes from the dispatcher's real address, because that inbox was compromised two weeks ago. Your settlement clerk updates the remit-to on a Tuesday. On Friday, the carrier's largest week of the quarter clears quick-pay into an account nobody at the carrier has ever seen.

Three weeks later the real carrier calls asking where its money is. You have paid once. You may now have to pay again, and if you refuse, the carrier's next call is to your surety.

Payment diversion is not a cybersecurity problem finance can hand to IT. It is a settlement-control problem where operations, accounting, and carrier records meet. Between the ACH network's new fraud-monitoring rules, the broker financial responsibility rule that took effect in January, and year-end volume and staffing gaps, the cost of getting it wrong went up in 2026.

The numbers behind the inbox

Start with federal data. The FBI's 2025 Internet Crime Report, released in April 2026, logged 24,768 business email compromise complaints with $3,046,598,558 in reported losses, up from 21,442 complaints and about $2.77 billion in 2024. The report's guidance on recovery is blunt: when a fraudulent transfer is discovered, "time is of the essence."

Freight is a named target. On April 30, 2026, the FBI's Internet Crime Complaint Center issued a public service announcement on cyber-enabled strategic cargo theft. It described attackers entering broker and carrier systems through spoofed emails and fake links, then changing a legitimate carrier's contact information with FMCSA and updating insurance details so the hijacked identity looks clean. It put 2025 U.S. and Canada cargo theft losses at nearly $725 million, a 60% increase over 2024. The same playbook that steals a load also steals a settlement: the attacker who controls a carrier's inbox and its FMCSA contact record can request a bank change that passes every check your team currently runs.

Industry data points the same way. A Q2 2026 freight fraud index from a carrier-identity analytics provider, published July 28, 2026, found communication-based attacks (compromised inboxes, spoofed emails, account takeovers, and impersonation calls) made up 50% of classified fraud vectors, up from 42.7% in the first quarter. Ownership-change fraud rose to 25.6% of reported thefts. Fake identities are getting harder to create, so criminals borrow trust that already exists.

Carriers feel it on the receiving end. A March 2026 owner-operator survey by a trucking trade publication found that among respondents who had been scammed, 28% documented losses of $10,000 or more, and 15% reported their own business identity had been stolen.

Why the broker usually eats it

Two legal facts decide who pays when a settlement goes to the wrong account.

The carrier is still owed. If you paid an impostor, you have not paid the carrier. Your obligation under the rate confirmation is unchanged, and an honest carrier who hauled the load will pursue it.

A real notice of assignment changes who you must pay. Under UCC Section 9-406, once an account debtor receives an authenticated notice that a receivable has been assigned, it "may not discharge the obligation by paying the assignor." If the carrier's factor sent a valid notice, paying the carrier does not count, and the factor can collect from you again. The same section gives you a tool: you may request reasonable proof of the assignment, and until the assignee provides it, you can pay the assignor. Forged notices exploit the first rule. Verification uses the second.

Then add the financial responsibility rule. Since January 16, 2026, under 49 CFR 387.307, a surety or trust provider must notify FMCSA within two business days when a claim payment, a judgment, or a determination of financial failure drops a broker's BMC-84 bond or BMC-85 trust below $75,000. FMCSA then serves notice, and unless the broker shows within seven business days that the security was restored, the claims were satisfied without bond assets, or the notice was an error, FMCSA suspends its operating authority. An unpaid carrier claim used to be a slow dispute. Now a claim the surety deems valid can put your authority on a clock, and a diverted payment you refuse to make good can become that claim.

The ACH rules that now apply to you

Most brokers and many carriers originate ACH credits to pay carriers, owner-operators, and vendors. That makes them non-consumer originators under the ACH network's operating rules. The network's fraud-monitoring amendments took effect in two phases: March 20, 2026 for the largest originators (6 million or more ACH entries in 2023) and June 22, 2026 for every other non-consumer originator, regardless of volume.

Each covered originator must establish and implement risk-based processes and procedures "reasonably intended to identify" entries that are unauthorized or authorized under false pretenses, and review them at least annually. The rules define false pretenses as inducing a payment by misrepresenting identity, authority to act for another person, or "the ownership of an account to be credited." That last clause is a remit-to change fraud, word for word.

Expect your bank to ask what your process is. "We call the carrier" is not a process unless you can show which number, who called, when, and what happened to the payment meanwhile.

Decision 1: Treat every remit-to change as an unverified payee

Decide the rule, then make it unskippable:

• Verify out of band, from a number you already had. Use the contact on file before the request arrived, or the FMCSA-listed number, never the number in the email or on the new letterhead. Because attackers change FMCSA contact records, a just-changed registry phone number is a warning, not a confirmation.

• Confirm the account belongs to the payee. The account name should match the carrier's legal entity or its factor of record.

• Freeze, then cool off. Hold all open settlements to that payee once a change request arrives, and set a cooling period before the new account goes live.

• Separate duties. The person who receives the request should not be the person who approves it, and neither should be able to release the first payment alone.

Decision 2: Decide whether quick-pay waits for verification

Quick-pay is where diversion pays off fastest, because it compresses the time between the fraudulent change and the money leaving. Carriers value fast pay, and many brokers earn fee revenue on it. A defensible middle ground: speed is earned by verified payees. A new carrier, a changed bank account, or a new factor is not quick-pay eligible until verification is complete. Carriers with stable, verified banking keep their terms. Impostors cannot wait out a hold; honest carriers usually accept one explained up front.

Decision 3: Define how you handle notices of assignment and releases

Write down the procedure before the next forged one arrives:

• Verify every new notice of assignment with the factor through its independently sourced main line, and confirm the client relationship and remit-to.

• Require a release letter from the outgoing factor before paying a carrier directly after a "we left our factor" message, and verify that release the same way.

• Use your Section 9-406 right to request proof when anything does not reconcile, and record the request and the response.

Decision 4: Decide your offset and short-pay policy before a carrier tests it

Fraud and disputes collide at year-end. Shippers short-pay, claims land, and some broker contracts allow offsetting: withholding payment on prior uncontested loads to cover a claim on a later one. The March 2026 owner-operator survey found 71% of respondents had never had an offset clause invoked against them, and 9% said they had fought one off.

Under the financial responsibility rule, every unresolved carrier dispute is a potential bond claim. Decide in advance which deductions are allowed, which require a documented claim, who approves them, and how fast the carrier hears about it. A deduction with a reason code, an approver, and a dated notice is defensible. A net payment with no explanation is how a disputed $1,200 becomes a surety claim.

Exposure by business model

Brokers carry the most direct risk: thousands of payees, daily remit-to changes, and a bond that can now trigger suspension quickly. The priority is a verified-payee standard, quick-pay eligibility tied to it, and an offset policy that keeps disputes off the surety's desk.

Asset carriers are on both sides. Their inboxes and FMCSA contact records are how attackers redirect their receivables. Protect dispatch and billing mailboxes, watch for unauthorized FMCSA record changes, and tell every broker and factor that banking details never change by email alone. Carriers that pay owner-operators or subcontractors by ACH are also originators under the June 2026 rules and need the same payee controls in their own payables.

Hybrids have both exposures plus a separation problem. Owner-operator settlements and brokered carrier payments often run through the same team and bank file. Keep payee populations, approval rules, and change histories distinct, so you can show your bank and surety which control governed which payment.

Year-end pressure makes all of this worse

The last weeks of the year combine heavy payment runs, holiday coverage gaps, and pressure to clear payables before close. A request that lands the week before a holiday gets less scrutiny. Decide now who approves settlements during holiday weeks, whether bank changes are frozen in that window, and who can call your bank for a recall. The FBI's advice is to contact your financial institution immediately, request a recall, and file a complaint. That requires a named owner and a written escalation path, not a shared inbox.

Encoding the control so it survives the busy week

No two freight businesses pay the same way. Your factor mix, quick-pay program, owner-operator settlements, and offset terms are specific to you, which is why a generic checklist fails in December. Operations that hold up encode the policy in the workflow itself: a payee status that blocks payment while a bank change is pending verification, permissions that limit who can edit remit-to fields and who can approve the first payment to a new account, required fields for the verification call (number used, person reached, time), deduction reason codes tied to the claim record, and an audit trail your bank, your surety, or a court can read. When those rules live in your system rather than in one experienced clerk's head, the control works on the day that clerk is on vacation.

FAQ

Who is liable if a broker pays a carrier's settlement to a fraudster?

Usually the broker, because paying an impostor does not satisfy what it owes the carrier that hauled the load. The carrier, or its factor under a valid notice of assignment, can still pursue payment, and an unpaid claim can be filed against the broker's bond.

Do the 2026 ACH fraud-monitoring rules apply to freight brokers?

Yes, if the broker originates ACH credits as a business, it is a non-consumer originator covered since June 22, 2026 at the latest. It must have risk-based procedures reasonably intended to identify payments made under false pretenses, including misrepresented account ownership, and review them at least annually.

What happens to a broker's authority if a carrier claim drains its bond?

FMCSA can suspend it. Since January 16, 2026, the surety must notify FMCSA within two business days when the bond or trust falls below $75,000, and the broker then has seven business days from FMCSA's notice to restore it or show the claims were satisfied.

How should a broker verify a carrier's bank account change?

Verify it out of band with a known contact using a number you already had, confirm the account belongs to the carrier's legal entity or factor of record, and hold payments until both checks pass. Do not use contact details supplied in the change request itself.

Can a broker refuse a notice of assignment it cannot verify?

A broker can ask for proof first, because UCC Section 9-406 lets an account debtor request reasonable proof of the assignment. Until the assignee furnishes it, the broker may keep paying the carrier, but ignoring a valid, authenticated notice risks paying twice.