Phishing and Identity Theft: The Quote Form and the Fake FMCSA Email

What it is

Not every scam wants your deposit. Some want your identity — and in auto transport, stolen identity is the master key that powers the other frauds on this list. This scam runs in two directions: harvesting consumers through quote forms, and phishing carriers and brokers through emails that impersonate the federal regulator, FMCSA.

The carrier side is the more dangerous one. A carrier's FMCSA account is protected by credentials like a USDOT PIN and EIN. Criminals who collect those — plus a Social Security number — can take over the carrier's registration, change its information, and impersonate a legitimate carrier in fraudulent transport transactions. The real carrier finds out when victims start calling about cars they've never seen.

How it works, step by step

1. The harvest. Generic quote forms collect names, phone numbers, emails, addresses, and vehicle details — then sell or share the data with unverified brokers. Consumers get flooded with calls; worse, their real shipment details become raw material for convincing targeted phishing.
2. The impersonation email. Carriers receive messages that look like they come from FMCSA — fake "safety audit" notices with sender addresses imitating official ones (safety@fmcsa.gov, audit@fmcsa.gov) and replies routed to look-alike domains. FMCSA issued a phishing alert about exactly this in September 2026.
3. The demand. The email requires the carrier to submit Social Security numbers, USDOT PINs, EINs, driver's licenses, and insurance certificates — under threat of fines if they don't respond within about a day.
4. The takeover. With a PIN, EIN, and SSN, attackers access the carrier's FMCSA account, alter its registration records, and use the stolen identity to book fraudulent loads — including auto transport — while the legitimate company knows nothing.
5. The same trick works by phone and text. Scammers have also requested copies of carriers' commercial driver's licenses directly; industry reporting notes that CDL copies are used to change federal registration records and hijack DOT numbers.

Red flags

• A quote form asks for sensitive personal or financial data — an SSN or bank details — just to give you a price.
• Any email or text demanding credentials, PINs, or license copies under threat of fines, especially with a one-day deadline.
• Sender addresses or links that don't resolve to genuine .gov domains.
• Callback numbers that exist only inside the message you received.
• Unsolicited "carrier" or "broker" outreach you can't verify independently.

How to protect yourself

• Know what a legitimate request needs. A price quote requires shipment details — vehicle, route, dates. Nothing more. No legitimate quote process needs your Social Security number or bank account.
• Treat deadlines as a tell. Regulators don't collect PINs and SSNs by email under 24-hour threats. FMCSA's real safety-audit communications come from its dedicated mailboxes or the assigned state entity — and if you're a carrier, you can verify any audit notice through FMCSA's official channels before responding to anything.
• Guard documents in context. There's a difference between a document request that arrives out of nowhere — an email, a text, a link from a stranger — and a secure upload inside an account you created on a platform you navigated to yourself. Never send license or identity documents by email or text to someone who contacted you. As one industry publication put it: if you're dealing with a reputable broker, they are not going to ask you for a copy of your driver's license by message — if they're requesting it that way, that's a red flag.
• Verify callback numbers independently. Find the company's number from its FMCSA record or official listing — never from the suspicious message itself.
• If you're a carrier, protect your PIN like a password and review your FMCSA registration information periodically for changes you didn't make.

If it already happened

• If you sent credentials or documents, assume they're usable. Contact FMCSA about your registration, change compromised passwords and PINs where possible, and monitor your authority records for alterations.
• If you're a consumer whose data was harvested, expect targeted phishing that references your real shipment. Verify any "update" about your transport by calling the company's independently listed number.
• Place a fraud alert with the credit bureaus if you disclosed an SSN or financial credentials, and consider a credit freeze — it's free and reversible.
• Report it to the FTC (ReportFraud.ftc.gov). Carriers should also report impersonation through FMCSA (National Consumer Complaint Database, 1-888-DOT-SAFT) so the stolen identity gets flagged in the system victims will check.

Dispatch A Car's own process is built around this distinction: carriers enter their FMCSA credentials and upload documents inside their registered account on the platform — never by email, never by text, and never in response to a message we sent asking for them.