Double Brokering Scams: The Hacked Carrier Inbox Behind an Alleged $800K Cargo Theft
Double brokering is when a party that accepted a load as a carrier quietly passes it to a different carrier without the shipper’s or broker’s consent, so the truck that shows up is not the one you vetted. Its more dangerous cousin is carrier impersonation, where nobody legitimate ever had the load at all. A 2026 federal case in Massachusetts shows how that second scheme passed every routine check, and what would actually have stopped it.
TL;DR
- Double brokering means a load is handed to an unvetted carrier without consent, and re-brokering without FMCSA broker authority is illegal under 49 U.S.C. § 14916.
- The statute sets a civil penalty of up to $10,000 per violation, which FMCSA’s inflation-adjusted schedule now lists as up to $13,676, plus liability for the injured party’s claims.
- In the Massachusetts case, prosecutors allege hacked carrier email accounts were used to book four loads that DOJ says were worth more than $800,000.
- The DOT number, the MC number and even the FMCSA-registered email address were real, so the usual checks confirmed the wrong thing.
- A callback to the carrier on a number you already hold, made before loading, would have stopped each load, and it is how the crab theft was uncovered a day too late.
Table of Contents
- What is double brokering?
- Is double brokering illegal? Federal law and penalties
- Double brokering vs. carrier impersonation
- The case: one hacked inbox, four loads
- Case timeline
- The numbers
- Warning signs
- How to prevent double brokering
- Perspective: verify the person, not the mailbox
- Where Admiral fits, and where it doesn’t
- FAQ
- Sources
What is double brokering?
Double brokering is when a party accepts a load as the carrier, then re-brokers it to another carrier without the shipper’s or original broker’s knowledge or consent, usually keeping part of the rate. Without FMCSA broker authority, that is also unauthorized brokering under federal law. Either way, the truck at your dock isn’t the carrier you vetted.
The term is industry shorthand, not a regulatory one. The federal definitions in 49 CFR 371.2 define a broker as a person who, for compensation, arranges or offers to arrange transportation by an authorized motor carrier. A carrier arranging shipments it has legally bound itself to haul is not acting as a broker. “Double brokering” doesn’t appear there.
In double brokering trucking cases, the freight often still arrives, but on a truck and insurance nobody vetted. In the fraudulent version, the middleman collects from the broker and never pays the hauler. Freight people often use the same label for a third scheme, carrier impersonation, where a criminal poses as a real, vetted carrier from the start. Trade press used the double-brokering label for the case below. The federal complaint does not, and the difference matters for how you defend against it.
Is double brokering illegal? Federal law and penalties
Re-brokering without broker authority is illegal. Under 49 U.S.C. § 14916(a), a person may provide interstate brokerage only if it is registered as a broker under § 13904 and meets the financial security requirements of § 13906. A carrier that takes a load and arranges for someone else to haul it, without its own broker registration, is brokering illegally.
- Civil penalty: anyone who knowingly authorizes, consents to or permits unauthorized brokering is liable for up to $10,000 per violation (§ 14916(c)). FMCSA’s inflation-adjusted schedule in 49 CFR Part 386, Appendix B, currently lists up to $13,676 per violation.
- Private liability: the violator is also liable to the injured party “for all valid claims incurred without regard to amount.”
- Personal liability: liability is joint and several across the company and its officers, directors and principals (§ 14916(d)).
When double brokering turns into theft, prosecutors bring criminal charges. Here they are interstate transportation of stolen goods (18 U.S.C. § 2314, up to 10 years) and conspiracy (18 U.S.C. § 371, up to 5 years), each with a maximum fine of $250,000.
Double brokering vs. carrier impersonation
| Classic double brokering | Carrier impersonation (this case) | |
|---|---|---|
| Who wins the load | A real carrier | Someone posing as a real carrier |
| Named carrier involved? | Yes, then it hands the load off | No. The real carrier never booked it |
| Usual outcome | Delivered, but by an unvetted truck | Freight diverted and resold |
| What catches it | Matching the truck at the dock to the rate confirmation | Confirming the booking with the carrier on a number you already hold |
The case: one hacked inbox, four loads
Romoy Forbes, 31, of Deer Park, New York, is charged with interstate transportation of stolen goods and conspiracy. He pleaded not guilty on April 7, 2026, and was released on conditions. Nothing below has been proven in court. Everything comes from the federal complaint affidavit and U.S. Attorney’s Office releases.
According to the complaint, the DOT number, the MC number and, in the crab incident, the carrier’s FMCSA-registered email address all checked out. Someone else had simply taken over that inbox first.
The inbox. Prosecutors allege that a co-conspirator, saved in Forbes’s phone only as “Josh,” gained unauthorized access to real carriers’ business email accounts and used them, and in one case a phone call, to accept posted loads as those carriers. One email from a hacked account, quoted in the complaint, read: “Hey my driver is checked in, we need pu numbers.”
The pickup. According to the affidavit, Forbes drove to each pickup himself and showed his own New York State ID. Surveillance video at two of the three documented sites captured his face. Nobody had to sneak past anything.
The photo. When warehouse staff asked for a photo of the truck, a routine anti-fraud step, the co-conspirator allegedly emailed photos of a gray truck with the real carrier’s logo and MC number. Prosecutors say Forbes had driven a red one. In the crab incident, staff did not notice.
The tracking. When the shipper asked to enroll the driver in GPS tracking, the co-conspirator allegedly supplied a phone number that was not Forbes’s. The shipper ended up tracking a phone, not its freight.
The crab. On July 15, 2025, Forbes allegedly picked up 33,750 pounds of frozen snow crab, worth about $325,000, in Worcester, Massachusetts. It was bound for Jacksonville, Florida, and it never arrived. Cellphone geolocation instead put Forbes and the load at a grocery-store loading dock in Queens. The next day, the shipper called the real carrier and learned it had been hacked and had never booked the load. When the shipper called Forbes, he blamed a dispatcher named “Josh.”
The rest. Prosecutors allege the same pattern moved three more loads: beer from Newark, New Jersey, meant for Maine but allegedly taken to Long Island; blueberries allegedly resold for $4,000 in Paterson, New Jersey; and about 14 pallets of designer cologne from Ronkonkoma, New York, taken under a third hacked carrier identity. The complaint says Forbes’s phone shows him negotiating at least two of those sales with a contact saved as “my customer for everything.”
Why every check passed
| Check | Meant to prove | What it proved here, per the complaint |
|---|---|---|
| DOT/MC lookup | The carrier exists and has authority | The carrier was real, but that says nothing about who was using its name |
| Email from the FMCSA-registered address | The message came from the carrier | The mailbox itself was compromised |
| Truck photo by email | The truck belongs to the carrier | It showed the real carrier’s truck, not the one at the dock |
| Driver ID at the dock | Who is picking up | It identified a person, not his link to the carrier |
| Phone tracking link | Where the load goes | It tracked whatever number had been supplied |
| Direct callback to the carrier | The carrier booked this load | It exposed the fraud, but one day after pickup |
Only the last check used information the people booking the load didn’t control.
Case timeline
| Date | Event | Source |
|---|---|---|
| June 6, 2025 | Beer worth ~$35,200 allegedly picked up in Newark, NJ; bound for Portland, ME, allegedly taken to Long Island | USAO-MA indictment release |
| June 25–27, 2025 | Blueberries allegedly picked up in Winslow Junction, NJ, via a second hacked carrier email; resold for $4,000 in Paterson, NJ | Complaint affidavit |
| July 14, 2025 | Crab load booked by phone in the name of a hacked carrier; paperwork sent to its inbox | Complaint affidavit |
| July 15, 2025 | 33,750 lbs of snow crab (~$325,000) allegedly picked up in Worcester, MA; photos of a different truck emailed | Complaint affidavit |
| July 16, 2025 | Load missing; shipper calls the real carrier and learns it never booked the load | Complaint affidavit |
| July 25, 2025 | ~14 pallets of cologne allegedly picked up in Ronkonkoma, NY under a third hacked identity | Complaint affidavit |
| Jan. 14, 2026 | FBI agent signs the criminal complaint affidavit | Case 4:26-mj-04061-DHH |
| Feb. 5, 2026 | Forbes arrested on Long Island | USAO-MA release |
| Apr. 7, 2026 | Pleads not guilty in Worcester; DOJ announces indictment and adds the beer theft | USAO-MA release; Boston Globe |
The numbers
- Over $800,000: DOJ’s total for the four alleged thefts, in the headline of its indictment release.
- About $325,000 in snow crab, about $430,000 in cologne (some outlets report $433,830), and $35,200 in beer.
- $4,000: the alleged resale price of the blueberries. No shipment value has been published.
- About 24 hours: the time between the crab pickup and the call that exposed it.
Verisk CargoNet’s Q1 2026 report logged 767 supply-chain crime events across the U.S. and Canada, with $131.58 million in estimated losses. Seafood targeting “climbed sharply,” and personal care and beauty thefts rose 178% from Q1 2025, from 18 events to 50. CargoNet named credential harvesting, the compromise of business email used by carriers and brokers, as a primary tactic. “The anti-fraud tools the industry has deployed are working, they’re forcing criminals to invest more in elaborate schemes,” said Keith Lewis, its vice president of operations.
Warning signs
None of these proves fraud alone. Each is a reason to verify before release.
- A message from the carrier’s correct address moves the conversation to a new phone number or a dispatcher you’ve never dealt with.
- A truck photo emailed on request doesn’t match the vehicle at the dock in color, unit number or the name and MC on the door.
- The tracking phone number differs from the one the driver gives at check-in.
- The carrier on the rate confirmation doesn’t match the truck, the driver’s paperwork or the bill of lading. This is the classic sign of double brokering in freight.
- Someone presses for pickup numbers before your confirmation steps are done.
- After pickup, tracking goes dark, ETAs slip, and the blame falls on a third party you can’t reach.
- When you call the carrier yourself, it has no record of the load. Treat that as a theft in progress.
How to prevent double brokering
- Confirm every booking with the carrier on a number you already hold, before the truck arrives. Why: a hijacked inbox controls every reply. A call it didn’t start goes around it.
- Treat any change in contact details as a stop event. Why: impersonation depends on new numbers and new “dispatchers.”
- Add a no-re-brokering clause to carrier agreements and rate confirmations, and require written consent for substitutions. Why: it makes classic double brokering a clear breach and gives you grounds to refuse a different truck.
- Check the driver, tractor and trailer against a pre-alert sent before pickup. Why: an emailed photo can come from anywhere, but the truck at the dock can’t be faked the same way.
- Tie tracking to the vetted carrier’s equipment or app, not to a number supplied at booking. Why: a tracking link is only as trustworthy as the number behind it.
- Carriers: turn on multi-factor authentication for business email and watch for unusual logins. Why: none of these alleged thefts could have happened without the email compromise.
- Report quickly to local police, to the FBI’s IC3 for email compromise, and to FMCSA’s National Consumer Complaint Database. Why: it creates a federal record while the trail is fresh.
Pro Tip: Make the confirmation call from your own records, not the email signature, and make it before the dock door opens. A callback after a missed ETA only tells you what you lost.
Perspective: verify the person, not the mailbox
What stands out to me in this case is not how sophisticated it was, but how ordinary each step looked. Every check confirmed something real: the company existed, the address was its own, the truck in the photo had its logo. But each of those checks confirms the company. The theft happened in the gap between the company and whoever was speaking for it.
That is why I think “double brokering” undersells this kind of fraud. The term suggests a carrier going rogue. Here the carrier did nothing wrong, and its good record was the weapon.
The lesson I take is that verification has to run through a channel the requester doesn’t control, at the moment of release. Onboarding tells you a carrier was legitimate months ago, not who is at your dock today. CargoNet’s Lewis said the industry “needs to think beyond tender-phase controls,” and I agree.
— Gwagsi Glenn, Growth Analyst, Level5Fleet
Where Admiral fits, and where it doesn’t
We sell trailer security, so here is a plain account of what Admiral would and would not have done here.
Would have prevented: releasing each load to a carrier that never booked it. Admiral Resolve verifies who is making a pickup, access or change request, which company they act for, and whether they are authorized for that specific load. It records each decision in an audit trail, and emailed requests can be forwarded to it. That is the callback above, made repeatable. That matters in a hijacked-inbox case. Resolve doesn’t treat a real company or a real email account as proof: the named party confirms or declines the request itself, so the instruction is verified with the person it claims to come from, not with whoever controls the mailbox. Our Admiral platform brochure calls this the one unverified link: a load can pass every other check while the person acting for a company was never verified. Resolve is free to start within fair usage limits.
Prevented upstream, outside Admiral: the email compromise itself, which is a job for the carrier’s own email security.
Would not have helped: Admiral Enforce, the trailer door lock and the immobilizer keep trailers locked and immobilized until movement is authorized. Here, the cargo was allegedly loaded into equipment the driver brought. Nobody broke into anything. The failure was an identity failure. Admiral’s GPS runs on Admiral-equipped trailers, so it would not have shortened the gap either.
For classic double brokering: Admiral Execute carries shipper-approved changes, including carrier swaps, into what dispatch, dock and gate teams see. It is designed to protect against unauthorized carrier swaps, so a substitution nobody approved has no approval behind it.
To put every release behind a verification step, start with Admiral Resolve. There’s no hardware or contract to start.
FAQ
Is double brokering illegal?
Yes, when the party re-brokering has no FMCSA broker registration. Under 49 U.S.C. § 14916, brokering without registration and financial security exposes the company and its officers to civil penalties and to the injured party’s claims. When a registered broker re-brokers a load against its contract terms, the dispute usually turns on that contract, so ask a transportation attorney about your own agreements.
What is the penalty for double brokering?
The statute sets up to $10,000 per violation, and FMCSA’s inflation-adjusted schedule currently lists up to $13,676. The violator is also liable for all valid claims of the injured party. Theft charges such as 18 U.S.C. § 2314 can add up to 10 years in prison.
What is a double brokered load?
It is a load assigned to one carrier and then handed to another without the shipper’s or broker’s consent. The telltale sign is a mismatch between the carrier on the rate confirmation and the truck or paperwork at pickup.
How do I report double brokering to FMCSA?
File through FMCSA’s National Consumer Complaint Database at nccdb.fmcsa.dot.gov, which covers carriers, brokers and other intermediaries. Report stolen freight to local police, and report compromised business email to the FBI’s IC3.
What are the most common freight broker scams?
The most common are double brokering, carrier identity theft using a real carrier’s DOT and MC numbers, and business email compromise, where a hijacked inbox books or redirects loads. Verisk CargoNet’s Q1 2026 report names credential harvesting and carrier impersonation as central to organized cargo theft.
Sources
- U.S. v. Romoy Forbes, Affidavit in Support of Criminal Complaint, Case 4:26-mj-04061-DHH (D. Mass., Jan. 14, 2026): https://www.justice.gov/d9/2026-02/usa_v._romoy_forbes_-_complaint_affidavit.pdf
- U.S. Attorney’s Office, District of Massachusetts, “New York Man Charged in Multi-State Organized Cargo-Theft Conspiracy” (Feb. 5, 2026): https://www.justice.gov/usao-ma/pr/new-york-man-charged-multi-state-organized-cargo-theft-conspiracy
- U.S. Attorney’s Office, District of Massachusetts, indictment release, “Defendant allegedly stole cargo containing over $800,000 worth of beer, snow crabs, blueberries and cologne” (Apr. 7, 2026): https://www.justice.gov/usao-ma/pr/new-york-man-charged-multi-state-cargo-theft-conspiracy
- The Boston Globe, “Man arrested for cargo theft pleads not guilty…” (Apr. 7, 2026): https://www.bostonglobe.com/2026/04/07/metro/ny-man-arrested-stealing-cargo-snow-crab-worcester-warehouse/
- CDL Life, “Man used hacked trucking company email accounts to steal costly loads of crabs and cologne”: https://cdllife.com/2026/man-used-hacked-trucking-company-email-accounts-to-steal-costly-loads-of-crabs-and-cologne-officials-say/
- Overdrive, “FBI details double-brokering cargo theft scheme in felony charges for trucker”: https://www.overdriveonline.com/business/article/15816540/fbi-details-doublebrokering-cargo-theft-scheme-in-felony-charges-for-trucker
- Verisk CargoNet, “2026 First Quarter Supply Chain Risk Trends Analysis”: https://www.cargonet.com/news-and-events/cargonet-in-the-media/2026-q1-theft-trends/
- Carrier Management, “Despite 5% Decrease in Crimes, Estimated Q1 2026 Cargo Theft Loss Costs Remain High” (Apr. 27, 2026): https://www.carriermanagement.com/news/2026/04/27/287237.htm
- 49 U.S.C. § 14916, Unlawful brokerage activities: https://www.law.cornell.edu/uscode/text/49/14916
- 49 CFR 371.2, Definitions: https://www.ecfr.gov/current/title-49/section-371.2
- 49 CFR Part 386, Appendix B, Penalty Schedule: https://www.ecfr.gov/current/title-49/part-386/appendix-Appendix B to Part 386
- 18 U.S.C. § 2314: https://www.law.cornell.edu/uscode/text/18/2314
- 18 U.S.C. § 371: https://www.law.cornell.edu/uscode/text/18/371
- 18 U.S.C. § 3571 (fine amounts): https://www.law.cornell.edu/uscode/text/18/3571
- Federal Register, FMCSA notice on the National Consumer Complaint Database (June 6, 2025): https://www.govinfo.gov/content/pkg/FR-2025-06-06/html/2025-10310.htm
- FMCSA National Consumer Complaint Database: https://nccdb.fmcsa.dot.gov/
- FBI Internet Crime Complaint Center (IC3): https://www.ic3.gov/