Who Released the Load? U.S. Holiday Cargo Theft and the Pickup Verification Gap in 2026

On the Wednesday before Christmas, a shipper's dock in the Inland Empire loads 22 pallets of televisions for a broker it has used for years. The driver presents a bill of lading with the right load number, a cab number that matches the carrier on the rate confirmation and a phone number that answers. The shipping clerk, covering for two people already on holiday, signs the freight out at 4:40 p.m. The real carrier calls the broker the next morning asking where its pickup went. By then the trailer has been transloaded and the televisions are gone.

The scenario is illustrative, but the failure mode is the one that is growing. Nobody broke a fence. The freight was handed to someone who passed every checkpoint actually checked. For the 2026 holiday peak, the operating question is not whether theft goes up between Thanksgiving and New Year. It does. The question is which person, at which step, has the authority and the information to refuse a release, and whether your workflow forces that step to happen when staff are thin and pressure is high.

Fewer thefts, bigger losses, more deception

A cargo-theft analytics firm's Q3 2026 report recorded 547 supply chain crime incidents across the U.S. and Canada from July through September. That is down 33% from Q3 2025 and 19% from Q2. Losses moved the other way. Estimated Q3 losses were $230.1 million, up 12% from $205.1 million a year earlier, and year-to-date losses through September reached $718.9 million, up 39%, even as incidents fell 25% (from 2,755 to 2,072). The average value of thefts with a documented value rose about 72%, from $261,115 to $448,456. Nineteen Q3 thefts topped $1 million, against nine a year earlier.

The mix matters more than the totals. Fictitious pickups fell only 6% (138 incidents versus 147) while everything else fell sharply, so their share of reported activity rose from 18% to roughly 25%. California, New Jersey, Texas and Illinois accounted for 57% of the quarter's incidents, with Los Angeles, San Bernardino, Riverside, Harris and Cook counties standing out.

The FBI framed the same trend in an April 30, 2026 public service announcement on cyber-enabled strategic cargo theft. It said estimated U.S. and Canadian cargo theft losses reached nearly $725 million in 2025, a 60% increase over 2024, with confirmed incidents up 18% and average value per theft up 36% to $273,990. It described a repeatable chain: phish a broker or carrier with a fake carrier agreement or "service complaint" link, install remote access software, post fake loads from compromised accounts, book real loads as the compromised carrier, change that carrier's contact and insurance details with FMCSA, then double broker the freight to partially unwitting drivers before transloading it.

Do not let the strategic theft headlines erase the other half. The Americas chair of a transported-asset security association recently told trade press that strategic theft has grown from under 3% of U.S. cargo theft before 2020 to roughly 30% or more, but stressed that conventional physical theft is still the majority. Holiday peak is when both peak together.

What the holiday window actually looks like

The same analytics firm's December 2025 advisory reviewed five year-end windows (Dec. 23 to Jan. 2) and found 353 events, including cargo theft, tractor and trailer theft and supply chain fraud. Events rose from 49 in 2020 to 89 in 2024, about 82%. About 69% fell between Dec. 23 and Dec. 29, and Dec. 23 alone was the peak day with 56 events. Its Thanksgiving advisory a month earlier counted 79 thefts in the 2024 Thanksgiving analysis period, up 64.58% from 48 in 2023 and up from 29 in 2021. Food and beverage led, followed by household products, electronics, and vehicles and accessories.

Look at the 2026 calendar. Thanksgiving is Thursday, Nov. 26. Christmas Day and New Year's Day both fall on a Friday, which creates two long weekends where loaded trailers can sit from Thursday evening until Monday morning. Dec. 23 is a Wednesday, the classic last full shipping day before a lot of shippers go dark. That is when the fictitious pickup risk (rushed releases, covering staff, last-minute "carrier swaps") and the straight theft risk (loaded equipment sitting unattended over three nights) overlap.

The registration layer changed in 2026

One structural change deserves attention before peak. FMCSA's Motus registration system opened to all registrants on May 19, 2026, after legacy registration tools closed on May 14. Per FMCSA's April 29, 2026 Federal Register notice (91 FR 23144), every new applicant must pass identity proofing with a government ID and a face scan, the roughly 800,000 existing registrants verify the first time they access Motus, and a separate business verification service checks legal names, addresses, ownership and company officials.

Two cautions. First, the Phase II release did not eliminate MC numbers, introduce safety registration or change the BOC-3 process. Those were deferred to later rulemaking, so the MC number is still part of every vetting check and every scam. Second, the legacy Licensing and Insurance view now shows historical records, while current authority and insurance filings live in Motus public search. If your onboarding checklist, or a staffer's muscle memory, still validates authority against the old view, it may be confirming stale data. Identity proofing at registration also does nothing about an account taken over after registration, which is exactly the FBI's described pattern of attackers editing a real carrier's FMCSA contact and insurance details.

On the enforcement side, the Combating Organized Retail Crime Act (H.R. 2853) passed the House 348 to 60 on May 12, 2026, and has sat in the Senate Judiciary Committee since May 13. It would make theft from interstate shipments a money laundering predicate, allow aggregation of stolen value over 12 months and create a coordination center within Homeland Security Investigations. Even if it is attached to the FY2027 defense authorization bill, as freight groups are urging, it will not change who eats a loss this December.

Pickup verification: decide who can say no

Most shops already have a verification checklist. The gap is that it is advisory. The decisions that actually prevent a fictitious pickup are structural:

• Verify through channels you already hold. The FBI and the holiday advisories say the same thing: confirm pickups, carrier swaps and appointment changes by calling back a number already on file, not one in the email, text or signature block that requested the change. Familiar names and display addresses prove nothing in an account takeover.

• Lock the load after dispatch. Any change to carrier, driver, truck, trailer, pickup number or consignee after tender should reopen verification, not just update a field. Late "the original driver is sick, here's the new truck" calls are the single most common pressure point.

• Use a release code the shipper must match. A one-time pickup number generated by the party that booked the carrier, given to the driver only through the verified carrier contact, and checked by the shipper's dock, closes the gap in the opening scenario. Paper that looks right is not a credential.

• Capture identity at the door. The FBI recommends photographing the driver, license, tractor, trailer, plates, cab and truck numbers, and DOT and MC numbers. Treat that capture as a required step before a load can move to "picked up," not an optional upload.

• Track before you trust. Require live tracking connected before release, matched to the booked tractor.

The hard decision is who holds the stop authority. If a dock clerk can refuse a release only by escalating to someone who has left for the holidays, the release will happen. Name the after-hours approver for each shipper and each high-value lane now.

High-value and holiday-weekend rules

Straight theft is a parking and timing problem. Set explicit rules for the holiday window rather than relying on driver judgment:

• Value and commodity thresholds. Define which commodities and declared values trigger elevated rules (electronics, alcohol, tires, appliances, data center hardware, copper). Above the line, require team drivers or no-stop rules for a set radius from origin, which is where a lot of follow-off theft happens.

• No unattended loaded equipment over the long weekends. For Thanksgiving, Dec. 25 to 27 and Jan. 1 to 3, decide in advance whether high-value loads can be picked up at all on Dec. 23 or Dec. 31, or whether they are held at origin, moved into a secured yard, or delivered before close.

• Physical controls. Kingpin or landing gear locks, high-security rear door locks and air cuff locks on any staged trailer, and monitored, fenced, lit parking only.

• Dwell ceilings. Loaded equipment sitting outside a secured facility beyond a set number of hours should trigger an alert, not wait for Monday.

Who eats the loss

This is where asset carriers, brokers and hybrids diverge, and where many discover their assumptions only after a claim.

Asset carriers. Under the Carmack Amendment (49 U.S.C. 14706), a carrier that receives freight is generally liable for its actual loss, subject to limited defenses and any valid liability limitation. Your motor truck cargo policy is the backstop, and two exclusion families matter at peak. Unattended vehicle clauses often require the unit to be locked, attended or in a qualifying secured location. Voluntary parting or false pretense language can exclude freight surrendered to someone using forged documents. Read the endorsements before Thanksgiving.

Brokers. In a fictitious pickup, the named carrier may never have received the freight, which complicates any Carmack claim against it, and the shipper will look at whoever booked the move and whoever signed the release. Contingent cargo coverage is usually written to respond only when the carrier's coverage fails, and many forms have their own fictitious pickup limitations. If your shipper contracts make you liable as if you were the carrier, know whether your coverage actually follows that contract. (We covered broker negligent selection exposure on Oct. 22 and carrier payment diversion on Oct. 26; this is the freight version of the same identity problem.)

Hybrids. A brokerage running alongside a fleet faces both exposures, plus the reputational risk that a scammer impersonates your own carrier authority. Check your own Motus record through peak and treat any unexplained change as an incident.

Shippers. If the shipper released without matching the pickup code it agreed to require, that should affect allocation. Write it into the transportation agreement.

Re-verify before peak, not just at onboarding

Carrier identity is not a one-time fact. The FBI's description of attackers editing real carriers' FMCSA records means an approved carrier can become a vector months after it passed onboarding. Before Thanksgiving, re-verify active carriers on high-value or holiday lanes against Motus, confirm contacts by call-back, and freeze any carrier whose phone, email, insurance or remittance details changed in the last 30 days until someone confirms the change through a known channel. Several of the FBI's indicators, like new mailbox forwarding rules, are about your own inbox.

Encoding the rules

Every shop draws these lines differently. A reefer carrier hauling grocery freight, a brokerage moving consumer electronics out of Southern California and a hybrid running dedicated plus spot need different thresholds, approvers and holiday blackout rules. What they share is that rules living in a policy PDF fail on Dec. 23 at 4:40 p.m.

Serious operators encode them in their workflow. Load statuses that cannot advance to "dispatched" or "picked up" until verification fields, release codes and driver photos are complete. Holds that trigger automatically on any carrier, truck or consignee change after tender. Permissions that limit who can override a hold, with after-hours approvers named per customer. Commodity and value flags that apply holiday rules on their own. Carrier records that lock changes to contact and remittance details pending call-back. The system enforces the decision the business already made, especially when the people who made it are on holiday.

FAQ

When is U.S. cargo theft risk highest during the holidays?

Risk concentrates in the days just before and after Christmas. A five-year review of Dec. 23 to Jan. 2 windows found about 69% of events fell between Dec. 23 and Dec. 29, with Dec. 23 the peak day, and Thanksgiving week thefts have risen every year since 2021.

What share of cargo theft is fictitious pickups in 2026?

Fictitious pickups were roughly 25% of reported incidents in a Q3 2026 analytics report, up from 18% a year earlier. Their count fell only 6% while total incidents fell 33%.

Did FMCSA eliminate MC numbers with Motus?

No, MC numbers remain. Motus opened to all registrants on May 19, 2026 with identity and business verification, but FMCSA deferred eliminating MC and FF docket numbers to later rulemaking.

Does motor truck cargo insurance cover a fictitious pickup?

Often not fully, because many policies exclude or sublimit losses from voluntary parting or false pretenses. Check the specific endorsements and any buyback before peak season.

Is a broker liable when freight is released to an imposter?

It depends on contracts, coverage and facts, but brokers are frequently the party a shipper pursues. Contingent cargo coverage usually responds only when carrier coverage fails, so confirm how your policy treats fictitious pickups and get legal advice on your shipper agreements.