Carrier Identity Theft: 24 Missing Loads and a Borrowed Reputation
Carrier identity theft is when someone other than a trucking company’s real operators uses that company’s identity, its USDOT and MC numbers, email, history and even its owners’ names, to win freight it never intends to deliver. When the identity has been taken over rather than faked, every registration check passes, because the numbers are real. What still works is verifying the person behind the company, not just the company, and knowing during the trip whether the load is actually heading where it should.
TL;DR
- Carrier identity theft isn’t only about fake companies. In the case below, federal prosecutors allege a group bought or took control of established trucking companies, including their DOT and MC numbers, business email and the owners’ identities, then posed as the previous owners to book loads with freight brokers.
- According to the U.S. Attorney’s Office in Connecticut, at least 24 loads were allegedly stolen, starting around September 2025, and at times co-conspirators demanded ransom for a load’s return.
- Prosecutors put the retail value of the thefts they allege one driver was personally involved in at more than $12 million. Retail value is shelf price, not cost.
- Authority checks couldn’t have flagged this, because the companies were real. Verifying who controls a carrier is the preventive step. Independent, shipper- or broker-held tracking would most likely have shortened the time to know a load was gone, though court documents reportedly describe efforts to defeat tracking.
- Status: Nursulton Khaydarov, 33, is charged by indictment with one count of conspiracy. He pleaded not guilty on Oct 21, 2026, and is presumed innocent. No one has been convicted, and the investigation is ongoing.
Table of contents
- What is carrier identity theft?
- The case: established carriers under new management
- Case timeline
- The numbers
- The company, the person, the load: what each check verifies
- Warning signs of carrier identity theft
- How to prevent carrier identity theft: a 7-step checklist
- A perspective: continuity isn’t identity
- How Admiral maps to this case
- FAQ
- Sources
- Recommended
What is carrier identity theft?
Carrier identity theft covers any scheme in which a real motor carrier’s identity is used by people who don’t legitimately operate it. Trade coverage uses the term for a few related patterns. In one, criminals impersonate a carrier from the outside, using its numbers and a look-alike email or a compromised account, while the real company knows nothing. The FBI describes compromised carriers that “may not realize they are compromised until brokers contact them about missing loads booked under their authority” [6]. In another, the identity changes hands: a group buys or takes control of the company itself, so the numbers, history and inbox come along with it.
The second pattern, sometimes called a carrier takeover, is the one prosecutors allege in this case, and it’s harder to catch. An outside impersonator has to fake something, and fakes can be checked. In a takeover, nothing on the carrier’s record is fake. The authority is active, the history is real, and the email domain is the one brokers already have on file.
A chameleon carrier sheds a bad record by reopening under a new identity; a takeover acquires a good one. Our article on MC number fraud covers a case in which a jury convicted two men of using bought trucking companies to win loads. Prosecutors in the case below allege the same core move, plus one more: the group took on the owners’ identities and posed as them.
FMCSA’s March 13, 2026 bulletin told the industry not to sell, purchase or lease a USDOT number or MC authority “from an unknown person or outside of a legitimate corporate transaction” [9][10]. Legitimate acquisitions happen every day, which is exactly why a change of hands is so hard to read from outside.
The case: established carriers under new management
According to the U.S. Attorney’s Office for the District of Connecticut, the scheme began around September 2025. Prosecutors allege that the defendant “and others involved in the scheme purchased or otherwise assumed control of multiple motor carrier companies, including their U.S. Department of Transportation numbers, motor carrier identification numbers, business email accounts, and the identities of their owners” [1].
From there, the office says, the group “posed as the previous business owner” and “exploited the reputation and trust of an established business to obtain contracts for interstate shipments” [1]. Once a freight broker agreed a contract, a driver picked the shipment up from the distribution location. The load didn’t make it to its destination and was later reported stolen. “At times, co-conspirators made ransom demands for the return of the stolen load,” the release says [1].
Read that carefully: DOJ attributes the ransom demands to co-conspirators, not to the man charged, and the charge is a single count of conspiracy. Theft and ransom are not separate charges.
How the companies were acquired, and how the owners’ identities were taken on, hasn’t been disclosed [3], and we wouldn’t describe it if it had. What matters for prevention is the pattern: a real company, a real history, and someone else answering its email.
The prosecution names one defendant so far: Nursulton Khaydarov, 33, a driver. According to the indictment, he held a valid New Jersey commercial driver’s license, and prosecutors allege he also possessed five fraudulent driver’s licenses in other names, each bearing his photograph with altered features [1]. (We don’t repeat the names on those licenses. They may belong to real people.)
DOJ says the conspiracy involved at least 24 cargo loads, including hard drives, stereo equipment, clothing, electronics, computer equipment, food items and other goods. “To date, the estimated retail value of the stolen products of the cargo thefts Khaydarov was personally involved in is more than $12 million,” the office says [1]. That’s an allegation, and it’s a retail figure: what the goods would sell for on a shelf, which is higher than what they cost.
FreightWaves, citing the indictment and an FBI affidavit, reports that court records also describe concealment: plate switching, burner phones, “efforts to defeat electronic shipment tracking systems,” and false explanations for delayed freight [3]. Those are one outlet’s readings of court filings, not findings, and we go no further than the category names.
He was arrested on a federal criminal complaint on June 1, 2026, in Ontario, California. On Sept 22, 2026, a federal grand jury in New Haven indicted him on the conspiracy count, which carries a maximum of five years in prison. On Oct 21, he appeared in federal court in Bridgeport and pleaded not guilty. He has been detained since his arrest [1].
U.S. Attorney David X. Sullivan “stressed that an indictment is not evidence of guilt,” the release says. Charges are allegations, and a defendant is presumed innocent unless proven guilty beyond a reasonable doubt [1].
The FBI’s New Haven field office is leading the investigation, with the U.S. Department of Transportation’s Office of Inspector General, IRS Criminal Investigation, Homeland Security Investigations, and police in Fullerton and Ontario, California [1][2]. The affected carriers, brokers and shippers haven’t been identified, and the recovery status of the freight hasn’t been disclosed [3]. The investigation is ongoing, and the FBI is asking anyone with information to contact its New Haven office [1].
Case timeline
| Date | Event | Source |
|---|---|---|
| ~Sept 2025 | The alleged scheme begins; prosecutors say carriers were bought or taken over, with their numbers, email and owners’ identities | DOJ [1], FreightWaves [3] |
| Dec 19, 2025 | According to the FBI affidavit, a pistachio load leaves Terra Bella, CA, for Laredo, TX, and the driver presents an Illinois license that state records don’t match | FreightWaves [3]; FBI affidavit [11] |
| May 18, 2026 | According to the same affidavit, Ontario, CA, police stop a tractor-trailer linked to suspected thefts and find suspected counterfeit ID; the equipment is impounded and later searched under a federal warrant | FreightWaves [3]; FBI affidavit [11] |
| June 1, 2026 | Arrested in Ontario, CA, on a federal criminal complaint; detained since | DOJ [1] |
| Sept 22, 2026 | Federal grand jury in New Haven returns a one-count conspiracy indictment | DOJ [1] |
| Oct 21, 2026 | Arraigned in Bridgeport; pleads not guilty; DOJ announces the case | DOJ [1] |
| As of Nov 4, 2026 | Pre-trial. No trial date, plea change or additional defendants reported in the sources we reviewed; cargo recovery undisclosed | DOJ [1], FreightWaves [3] |
The numbers
| Figure | What it measures |
|---|---|
| ≥ 24 | Cargo loads in the alleged conspiracy |
| > $12 million | Estimated retail value of the thefts prosecutors allege the defendant was personally involved in |
| 5 + 1 | Fraudulent driver’s licenses alleged, plus one valid New Jersey CDL |
| ~9 months | From the alleged start (around September 2025) to the arrest (June 1, 2026) |
| 1 | Count charged: conspiracy |
| 5 years | Statutory maximum for that count, a ceiling, not a prediction |
Two cautions on reading these. The $12 million is a retail figure and an allegation, so it isn’t comparable with loss estimates that use cost or wholesale value. And 24 is a floor: DOJ says “at least.”
National data shows this pattern too. Verisk CargoNet estimates that 2025 cargo theft losses in the U.S. and Canada reached about $725 million, up 60% from 2024, while confirmed theft incidents rose 18% and the average value per theft rose 36% to $273,990 [5][6]. In the second quarter of 2026, CargoNet recorded 677 incidents, down 26% year over year, while estimated losses more than doubled to $304.6 million [4].
CargoNet attributed part of that Q2 drop to fewer “non-delivery schemes in which malicious actors acquired existing, reputable motor carriers, booked shipments under those companies’ established operating authorities and reputations, and picked up freight with no intent to deliver it,” especially in California and Texas [4]. That’s the pattern alleged here. CargoNet doesn’t tie the decline to any prosecution, and neither do we.
Highway, a carrier-identity platform, tracks the same pattern from the broker’s side, in its own data, and its figures cut the other way. Its Q1 2026 Freight Fraud Index reported a 169.6% year-over-year increase in change-of-ownership reports, with 399 change-of-ownerships flagged across carrier profiles [7]. In Q2 2026, Highway said change-in-ownership accounted for 25.6% of reported thefts on its platform, up from 23.0% in Q1, and described the ownership fraud that remains as “more difficult to detect because it often involves authorities with years of operating history” [8]. These are one vendor’s platform figures, not an industry census. Together with CargoNet’s, they suggest fewer of these schemes, but a larger share of the thefts that remain, and harder to spot.
The company, the person, the load: what each check verifies
A carrier takeover separates three questions onboarding usually treats as one: is this a real carrier?, is this person the one who runs it?, and is my load going where it should? Here is each control applied to what prosecutors allege.
| Control | Question it answers | Effect in this case |
|---|---|---|
| MC/USDOT authority lookup | Does the company exist, and is it authorized? | None. The authority was real. |
| Authority age and safety history | Does it have a track record? | None, arguably negative. An established record is what was allegedly acquired. |
| Insurance and document checks | Is the paperwork valid? | None reported. Nothing in the sources suggests the paperwork failed. |
| Email domain match | Does the contact match the company on file? | None. Prosecutors say the business email accounts themselves were taken over. |
| Ownership-change and control verification (carrier vetting) | Has the company changed hands, and is the person I’m talking to the owner on record, confirmed through a channel I sourced independently? | The preventive layer. It is the only check aimed at the question this scheme turned on. It’s a vetting function, not fleet visibility. |
| Identity check at pickup | Is the driver who his license says? | Not a fleet-visibility control. Prosecutors allege fraudulent licenses; catching those is a job for pickup identity verification and law enforcement. |
| Shipper- or broker-held tracking, delivery geofence, deviation alerts | Where is the load, and is it approaching the consignee? | Would most likely have shortened the time to know a load was gone. It wouldn’t have stopped the booking, and tracking was reportedly a target [3]. |
| After-the-fact investigation | What happened? | Built the case, after the freight was gone. |
The honest limit sits in the tracking row. FreightWaves reports that court records describe efforts to defeat electronic shipment tracking [3]. So we don’t claim any particular tracking would have survived. The lesson that does survive is simpler: when a load’s tracking goes dark mid-route, that is the alert. A signal that stops is information, not an absence of it.
Warning signs of carrier identity theft
None of these proves fraud alone. Each one is a reason to slow down before tendering a high-value load, or to escalate one already moving.
- A recent ownership or officer change on an established carrier, especially when it’s followed quickly by interest in high-value freight.
- The owner on record can’t be reached through a channel you sourced yourself, or every route to them runs through the same inbox that sent the bid.
- Familiar name, unfamiliar behaviour: new phone numbers, new dispatchers, or a change in how a long-standing contact writes or negotiates. The FBI’s advice is blunt: “familiar names or email addresses alone do not confirm authenticity” [6].
- Lanes, commodities or payment details that don’t fit the carrier’s past, such as an old regional carrier suddenly bidding on out-of-state electronics loads, or new remittance details around a booking.
- Tracking that stops, or was never shared, on a load where visibility was agreed.
- Vague or shifting explanations for a late load. FreightWaves reports that court records describe false explanations for delayed freight in this case [3].
- Any request for payment to return freight. That isn’t a negotiation. It’s a crime in progress and a call to law enforcement.
The first four are vetting signals. The last three are execution signals, and they still fire when the paperwork is perfect.
How to prevent carrier identity theft: a 7-step checklist
- Verify the person, not just the company. Why: as alleged, the numbers, history and email were genuine, so every company-level check would have passed. The question that mattered was whether the person booking the load was the owner on record.
- Treat a change of ownership as a new carrier. Why: an approval you gave last year was an approval of the people who ran the company then. Highway’s data suggests ownership changes are now a major share of reported thefts on its platform [8].
- Confirm through a channel you sourced independently. Why: if the inbox has changed hands, replying to it confirms nothing. The FBI recommends verifying shipment requests and pickups “using secondary methods prior to releasing any loads” [6].
- Hold your own visibility on high-value loads. Why: tracking the carrier controls shows you what the carrier chooses to share. Visibility the shipper or broker holds still works when the carrier is the problem.
- Treat lost signal as an incident, with an owner and a clock. Why: tracking was reportedly a target here [3]. A load that drops off the map mid-route should trigger the same escalation as a load that misses its window, not a wait-and-see.
- Document every party at pickup. Why: the FBI recommends keeping photos of drivers, licenses, vehicles and plates, plus DOT and MC numbers and contact details, because that documentation aids investigations [6].
- Decide your ransom response before you need it. Why: prosecutors allege some loads in this case came with ransom demands [1]. The time to agree who calls police and the FBI, and who talks to the shipper, is before a demand arrives, not during it.
Pro Tip: Pull your last 12 months of high-value tenders and count how many went to carriers whose ownership, officers or primary contacts changed in the 90 days before the load. If you can’t produce that number, that is the gap.
A perspective: continuity isn’t identity
Most carrier vetting rests on continuity: same number, same history, same email, same name on the filing. Continuity is a reasonable stand-in for trust when the thing you fear is a fake company, because fakes don’t have it. This case, as alleged, shows the flaw. Continuity is exactly what can be transferred. Prosecutors say the numbers, the inbox and even the owners’ identities moved together. If that’s right, every signal a broker was trained to trust arrived intact. Only the people behind it had changed.
The irony is aimed at the system, not at anyone in the case. The industry taught itself that older authority means lower risk, which made an established reputation worth having, and anything worth having that can change hands will eventually change hands for the wrong reasons. FMCSA had to tell the industry, in capital letters, that operating authority isn’t a commodity [9][10].
There’s a structural reason a scheme like this can run for months. Each broker sees only its own load, booked with a carrier whose numbers check out. Nobody in that chain sees all 24 at once. Shared reporting networks, such as the one Highway describes, exist to close that gap, but only if someone reports quickly [7].
I don’t think the answer is to distrust established carriers or to make legitimate acquisitions harder. The better move is to stop asking one check to answer three questions. Registration tells you the company is real. Control verification tells you who’s running it. Only in-transit visibility tells you what happened to the load, and when that visibility goes quiet, the quiet is the signal. CargoNet saw this tactic decline in California and Texas in the second quarter of 2026 [4], but a tactic that cools in one place tends to resurface wherever the checks look the same.
And none of this has been tested in court. DOJ’s own release stresses that an indictment isn’t evidence of guilt. The mechanism prosecutors describe is worth learning from either way.
— Gwagsi Glenn, Growth Analyst, Level5Fleet
How Admiral maps to this case
Would not have prevented it: ownership vetting. Nothing in Admiral checks who owns a motor carrier or watches for changes of ownership. That’s carrier vetting, a different product category. We’re not claiming Admiral would have stopped any load in this case from being booked or picked up.
Not claimed: identity verification on requests. Admiral Resolve, free to use within fair usage limits, verifies who is behind a pickup, access or change request: that it came from the real person, which company they’re acting for, and whether they’re authorized for that load. Its premise fits this case, since a company can be legitimate while the person using its name is not. But Resolve isn’t an ownership or onboarding check, and the sources don’t say how the owners’ identities were taken on or which channels the group controlled. So we can’t say whether it would have flagged anything here, and we don’t claim it would.
Could support shorter detection, where Admiral is on the asset. Admiral provides GPS-based location and movement data, and the Admiral Hub reports physical events and asset state back to Admiral when connected, leaving a record of what was permitted and what actually happened. That’s the kind of independent location data the “shortened” finding depends on. Three limits apply. Admiral only sees assets it’s installed on, and the sources don’t say whose trailers carried these loads. Admiral is built around on-asset enforcement, not geofence alerting, so consignee geofences and expected-arrival alerts belong in your visibility or TMS stack, with a person who acts on them. And because court documents reportedly describe efforts to defeat tracking, we make no claim that any system’s signal would have survived.
Where enforcement fits. Admiral Enforce keeps doors locked and trailers immobilized unless the conditions set in policy, such as location, time and state, are met, and records what was attempted. That governs access to the freight and movement of an asset whose owner set the rules. It doesn’t decide whether a carrier wins a load, which is where this case turned, and we don’t claim it would have changed the outcome here.
If you tender high-value freight, the question this case raises is simple: when a load leaves the dock, who other than the carrier knows where it is, and who notices when that stops? See how Admiral works, start with Admiral Resolve at no cost for the requests you approve today, or request an Enforce Pilot on your highest-value lane.
FAQ
What is carrier identity theft?
Carrier identity theft is the use of a real trucking company’s identity, its USDOT and MC numbers, email and name, by people who don’t legitimately operate it, usually to win freight and steal it. It ranges from outside impersonation, where the real carrier is a victim, to takeovers, where the company itself changes hands.
Can you buy a trucking company’s MC number?
Not as a standalone item. FMCSA’s March 2026 bulletin says a USDOT number belongs to the same legal person permanently and may not be sold, transferred, rented or leased, and that the agency will move to inactivate numbers and revoke registrations traded outside a legitimate corporate transaction [9][10]. Genuine company acquisitions are a separate matter.
How can a broker tell if a carrier has been taken over?
Look for recent ownership or contact changes, then confirm with the owner on record through a channel you found independently, not one supplied in the bid. Then require your own tracking on high-value loads, because a perfect paper record can’t tell you who is running the company this week.
What should you do if someone demands ransom for a stolen load?
Contact local police and the FBI immediately, and file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov [6]. Preserve every message, document every party involved in the load, and let law enforcement lead the response.
What is the defendant in the Connecticut case charged with?
One count of conspiracy, which carries a maximum of five years in prison. He pleaded not guilty on Oct 21, 2026, has been detained since his June 2026 arrest, and is presumed innocent. Theft and ransom are not listed as separate charges [1].
Sources
- U.S. Attorney’s Office, District of Connecticut, press release announcing the indictment and not-guilty plea, Oct 21, 2026 (updated Oct 22, 2026). Read the press release
- IRS Criminal Investigation, re-post of the U.S. Attorney’s Office release, Oct 2026. Read the IRS-CI release
- FreightWaves (Phil Brink), “Feds charge driver in alleged $12M cargo theft scheme built on hijacked carrier identities,” Oct 22, 2026. https://www.freightwaves.com/news/feds-charge-driver-in-alleged-12m-cargo-theft-scheme-built-on-hijacked-carrier-identities
- Verisk CargoNet, “Cargo Theft Losses More Than Double to $304 Million in Q2 Despite a Drop in Thefts, Driven by High-Value Metals and Technology Heists,” Aug 6, 2026. https://www.verisk.com/company/newsroom/cargo-theft-losses-more-than-double-to-$304-million-in-q2-despite-a-drop-in-thefts-driven-by-high-value-metals-and-technology-heists/
- Verisk CargoNet, “Cargo Theft Losses Surge to Estimated $725 Million in 2025,” January 2026. https://www.cargonet.com/news-and-events/cargonet-in-the-media/2025-theft-trends/
- FBI Internet Crime Complaint Center, “Cyber-Enabled Strategic Cargo Theft Surging,” Public Service Announcement I-043026-PSA, April 30, 2026. https://www.ic3.gov/PSA/2026/PSA260430
- Highway, “Q1 2026 Freight Fraud Index Report.” https://email.highway.com/hubfs/Highway_Q1%202026%20Freight%20Fraud%20Index%20Report.pdf
- Highway, “Freight Fraud Index, Q2 2026.” https://email.highway.com/hubfs/Highway%20Freight%20Fraud%20Index%20-%20Q2%202026.pdf
- Land Line (Mark Schremmer), “FMCSA warns against selling USDOT/MC numbers,” March 16, 2026. https://landline.media/fmcsa-warns-against-selling-usdot-mc-numbers/
- FreightWaves (Adam Wingfield), “FMCSA Just Issued a Bulletin Warning Carriers Not to Buy or Sell DOT Numbers,” March 13, 2026. https://www.freightwaves.com/news/fmcsa-just-issued-a-bulletin-warning-carriers-not-to-buy-or-sell-dot-numbers-here-is-why-that-warning-exists-and-what-it-means
- FBI affidavit in support of criminal complaint, United States v. Khaydarov, D. Conn. No. 3:26-cr-00189-SRU, Doc. 1-1 (via CourtListener). https://storage.courtlistener.com/recap/gov.uscourts.ctd.173202/gov.uscourts.ctd.173202.1.1.pdf