Gone phishing?

Email phishing scams are becoming more prevalent, especially for truckers.

Over the summer, the Federal Motor Carrier Safety Administration warned truck drivers of an email phishing scam that was targeting motor carriers.

The fake email appears to come from FMCSA and is focused on hijacking a motor carrier’s authority.

The OOIDA Foundation, which is the research and education arm of the Owner-Operator Independent Drivers Association, is working to inform truckers about the scam and how to avoid the bait.

As part of the most recent scam, emails appear to be from FMCSA and include a .gov domain. The emails often ask for a Social Security number or USDOT personal identification number.

“OOIDA’s Compliance Department has been inundated with calls from members describing a sophisticated phishing scam to get their PIN and business information,” the OOIDA Foundation wrote.

How the scam works

The official-looking email claims to be from FMCSA and asks you to fill out the attached forms about your trucking company. In most cases, the scammers also ask for your USDOT PIN.

Giving the scammers your PIN is where real trouble can start.

“Anyone with this information can now become you,” the OOIDA Foundation wrote. “Your MC and DOT numbers are easily discovered on the SAFER site, but the PIN is not listed and is to be safeguarded as a personal identifier.”

That information is enough for the scammer to hijack a motor carrier’s authority.

“The scammer can book a load or several loads with a shipper or through a broker and take those loads and sell them for 100% profit,” the OOIDA Foundation wrote.

A key thing to remember is that FMCSA will not ask for a motor carrier’s USDOT PIN on manual forms or over the phone.

Learn more about phishing scams

The OOIDA Foundation created an educational video aimed at helping truckers identify and prevent phishing scams.

FMCSA also provided some tips on how to avoid falling for the scam.

“Carriers should not fill out forms attached to the fake email,” FMCSA wrote. “In some cases, the phishing attempt also asks for a certificate of insurance and driver’s license to help protect the recipient against fraud. There is also a threat that if the recipient does not respond within a day, the individual will be fined, which is also not an FMCSA practice as part of the registration process.”

At first glance, the emails appear legitimate. FMCSA said the fake emails are originating from Safety@FMCSA.gov, Filing@FMCSA.gov, DOTFilings@FMCSA.gov or Audit@fmcsa.gov.

The agency said that none of these are legitimate email addresses and that none of them are used or owned by FMCSA.

If you receive an email from one of the addresses above, FMCSA advises:

• Do not click any suspicious links.
• Visit the Cybersecurity & Infrastructure Security Agency website.
• The Federal Trade Commission recommends following certain procedures for email verification.
• File a complaint with the FBI.
• Call FMCSA at 800-832-5660 if you are the target of these practices.

In July, OOIDA members began to report fraudulent emails purported to be from FMCSA. They included attachments of forms MCSA-5889 or MCS-150 and asked carriers for their USDOT PIN.

“Although the emails come from a .gov domain, these emails are not from FMCSA,” said Crystal Minardi of OOIDA’s Business Services.

“FMCSA will never ask you for your PIN on a manual form. We are advising our members not to reply.” LL