Fraud prevention has long been a top priority for carriers from fuel cards to DOT impersonation, but what happens when the carrier is the culprit?
Carriers are increasingly under pressure to provide Amazon-like real-time tracking, which can be a helpful alternative to the fielding of constant calls asking, “where’s my load?” But it also drives some carriers to spoof tracking data, overriding true GPS tracking to appear more reliable and maintain favorable standing with shippers and brokers.
Andrew Wimer, senior director of professional services at Descartes, said spoofing tracking data is a growing challenge that poses significant risks to supply chain integrity.
“Beyond the immediate concerns of theft and fraud, it erodes trust between shippers, brokers, and carriers,” Wimer said. “As the industry becomes more reliant on digital tracking solutions, the need for robust data validation processes will only increase.”
He said while modern technology can play a critical role in identifying and mitigating spoofing attempts, education and awareness are key. Collaboration between technology providers and industry stakeholders is also essential, he said, adding that sharing best practices and developing standardized protocols for data verification can help ensure everyone in the supply chain benefits from accurate and reliable tracking information.
“Many shippers and brokers may not fully understand the tactics used by carriers to manipulate compliance scores. By promoting transparency and leveraging technology to flag suspicious behavior, the industry can take proactive steps to reduce the impact of spoofing,” Wimer said.
Tricky tracking
Chain, an AI-powered freight visibility platform, has seen a 300% spike in fraudulent tracking instances across all the loads (over one million annually) tracking on its platform over the last two years.
Chain Co-founder Param Sandhu said carriers are using a variety of ways to trick freight visibility platforms like Chain into thinking a load is tracking when it is not.
What motivates this behavior?
Wimer said carriers spoof tracking data for a multitude of reasons, including mitigating costs, overcommitting capacity and improving on-time performance metrics.
Shippers and brokers often rely on performance metrics to decide which carriers to work with, he said, and carriers that appear to meet on-time delivery requirements are more likely to stay on preferred tender lists.
“By spoofing data, carriers can maintain a facade of punctuality and reliability, even when actual performance falls short,” Wimer said.
He said carriers also spoof tracking data to mask the fact that they are falling behind on less lucrative deliveries while prioritizing high-paying shipments first.
“Carriers may overpromise capacity to secure more business only to realize they don’t have the resources to fulfill all commitments on time,” Wimer said. “Carriers with more trailers than drivers will pick up multiple shipments, drop trailers in their yard and prioritize delivering the most profitable loads first.
“By spoofing tracking data, they create the appearance that all shipments are progressing as expected when in reality lower-priority loads may be delayed,” he added.
Carriers can also make it appear as though the shipment is still on the road while, rather than waiting in the yard, it is being shipped via rail. Wimer said some carriers move full truckload shipments via rail to save on operational costs, despite rail having slower transit times, and spoofing tracking data enables them to charge FTL rates while reducing their expenses.
Approach awareness
Carriers use various approaches to spoof location.
There’s an app for that. Sandhu said carriers can use GPS spoofing apps and GPS itinerary apps. The more common and simplest way is the GPS spoofing app, though only accessible on Android devices currently. In the Google Play store, there’s an app called Fake GPS Location by Lexa with over 50 million downloads. It reads, “Teleport your phone to any place in the world with two clicks! This app sets up fake GPS location so every other app in your phone believes you are there!”
It can also trick visibility platforms like Chain.
“These are often done prior to picking up the load when a carrier wants to trick a broker into thinking they are near the pickup location,” Sandhu said. “The carrier's goal here is to just pick up the load whether it is for the purpose of stealing or if they're running late but don't want to lose the load.”
He said GPS itinerary apps, which can trick the phone into thinking it is running a specific load route, are less commonly known by carriers but just as easy. There are two use cases Chain has seen these used for. That includes a new carrier or stolen identity carrier that is trying to steal a load. The app allows the carrier to track normally, from origin to destination, but the carrier is actually taking the load to different location, frequently southern California.
These apps are also used, he said, when the carrier is putting a load on rail.
“We've come across customers who have switched from other visibility providers and instantly notice one of their regular carriers that do multiple loads for them show up as "fraudulent" on our platform,” Sandhu said. “In this case, the carrier is showing that the load is tracking regularly on a street route, but what actually happens is the carrier is shipping the load intermodal on a train, which is far cheaper but takes longer … Sometimes brokers are facing this issue, and they don't even know it; carriers just make up an excuse for being late.”
He said Android and iPhone emulators are used for similar reasons.
Wimer said emulators allow users to run mobile apps on a computer and manipulate the device’s GPS coordinates, creating the illusion that a truck is in motion when it’s not.
Another method Wimer added is Voice Over Internet Protocol (VOIP) Numbers, which can be used to create multiple driver accounts or to obscure a driver’s true identity.
“While the primary function of VOIPs is to provide internet-based phone services, they can also be exploited in tracking systems,” he said. “For example, a carrier can register multiple fake accounts using VOIP numbers, then spoof locations to simulate a larger fleet or to mask the true location of shipments.”
He added that VOIPs also enable location spoofing by manipulating app permissions. When a tracking app relies on phone-based authentication, VOIP services can create virtual phones in different geographic regions, further complicating tracking accuracy.
Sandhu said there are other ways he has seen carrier spoof location.
It involves a more technical hack where the "carrier” – almost always a fraudster looking to steal the load – will figure out a way to bypass the visibility provider's mobile app and can, in a sense, "hack" the provider without them knowing and update the load.
“This technique involves individuals with a high degree of computer programming background, hence why we often see this happening in the organizations that perform organized freight theft today,” Sandhu said.
Chain’s platform detects many kinds of fraudulent location methods by using AI to uncover anomalies in the location data and their sources, while Descartes MacroPoint leverages proprietary algorithms and advanced data integrity checks to highlight potential fraud and detect suspicious behavior.
