Every load that leaves a dock rides on promise. The truck at the door belongs to the carrier the broker booked, and the person behind the wheel is who his license says he is. The shipping clerk signs the bill of lading on that promise. The broker pays on it. The insurer prices on it.
That promise is now what gets stolen.
Verisk CargoNet released its third-quarter cargo theft analysis Nov. 4. It recorded 547 cargo theft and supply chain crime incidents across the U.S. and Canada from July through September 2026, down 33% from the same quarter last year and down 19% from the second quarter. Estimated losses went the other way, up 12% to $230.1 million from $205.1 million. Through September, losses reached $718.9 million, up 39%, on 2,072 incidents, down from 2,755 over the same stretch of 2025. The average value of a theft with a documented loss climbed from $261,115 to $448,456. That’s a 72% jump.
Fictitious pickups, thefts where deception gets the freight instead of bolt cutters, accounted for 138 of the quarter’s incidents. That’s nine fewer than a year earlier. But their share of all reported thefts rose from 18% to about 25%. One in four. Nineteen thefts topped $1 million each, up from nine in the third quarter of 2025, and CargoNet said many involved high-value electronics and data center materials.
California led with 182 incidents, about a third of the total, concentrated in Los Angeles, San Bernardino and Riverside counties. New Jersey had 46, Texas 43 and Illinois 40. California, New Jersey and Texas together made up 49.5% of the quarter. Add Illinois and it’s 57%. Food and beverage was still the most stolen category at 94 incidents, with metals second at 63, including 34 loads of copper. Household goods had 49, electronics 46 and personal care and beauty 39.
The numbers show thieves are getting pickier. A prosecution in the District of Connecticut lays it out in an FBI affidavit and a grand jury indictment. Nearly every move the thieves made left a record somebody could have checked before the truck rolled.
The falling incident count is real, and part of it is the industry doing its job. When CargoNet released its first-quarter numbers in April, Keith Lewis, Verisk CargoNet’s vice president of operations, said the anti-fraud tools the industry has deployed are working. That’s true at the tender. Carrier vetting, load board monitoring and identity checks at booking have made the lazy scams harder.
The problem is what those tools pushed the thieves toward.
In that same April report, CargoNet named two ways organized groups now get control of a legitimate carrier’s identity. The first is credential harvesting: phishing and malware aimed at business email, phone systems and load board or broker platform logins. The second is direct acquisition: buying motor carriers that already hold valid operating authority so thieves can operate under real USDOT and MC numbers. CargoNet’s July advisory added that fraud actors were misusing software-based business phone systems to make and receive calls from a carrier’s verified numbers. In other words, the checks that happen when a load is booked are now checking an identity the thief already owns.
The case is United States v. Khaydarov, No. 3:26-cr-00189 in the U.S. District Court for the District of Connecticut. The criminal complaint was signed May 29, 2026, supported by an affidavit FBI Special Agent Ryan Oates of the New Haven field office swore to on May 27. A grand jury indictment was filed Sept. 22. It charges Nursulton Izzatulloevich Khaydarov, born in 1993 and described by the FBI as a lawful permanent resident living in or near Burbank, California, with conspiracy to transport stolen goods across state lines and to commit wire fraud. The indictment lists five aliases: Sayid Makhmudarov, Rustam Mavlonov, Dmitri Aganin, Roman Smirov and Kairat Nurtas. The charges are allegations. He has not been convicted.
The indictment says Khaydarov and his co-conspirators “purchased, took over, and otherwise assumed control of multiple motor carrier companies,” including their USDOT numbers, motor carrier numbers, business email accounts and the identities of their owners. They used those identities to book loads with brokers by email. They dispatched drivers, including Khaydarov, to pick up the loads. Then the loads never arrived.
Sometimes the conspirators used the compromised carrier email to demand a ransom from the broker, payable in cryptocurrency. Other times they offered an excuse about a delay and went quiet. The agent wrote that he believed the silence was meant to buy the driver time to offload the freight somewhere safe before anyone called the police. The indictment says the conspiracy involved at least 24 cargo thefts. The affidavit attributes more than 12 of them, and more than $8.5 million in estimated retail losses, to Khaydarov alone. The cargo included hard drives, stereo equipment, clothing, electronics, computer equipment, food, and nicotine products.
On Sept. 14, 2025, a little after 1 a.m., a driver picked up a load in Swedesboro, New Jersey, bound for Texas. It never got there. The affidavit says the driver was Khaydarov, using his real name, and that the load moved under a carrier called Artan Transportation LLC. His phone hit a cell tower covering the pickup site at 12:23 a.m., when the victim company called it. A search of one of his personal email accounts later turned up the bill of lading, which he had sent to a cloud printing service.
That was the last time, according to the FBI, that he used his own name at a dock. On Dec. 19, 2025, a load of pistachios left Terra Bella, California, headed for Laredo, Texas. The driver showed an Illinois driver’s license in the name of Sayid Makhmudarov. The Illinois Secretary of State told agents no such license had ever been issued under that number. The photocopy the shipper made at pickup shows Khaydarov’s face. The shipper wrote down the truck’s plate as New Jersey AT9035. The FBI believes it was AT903S, a plate that keeps appearing in this case.
On Jan. 9, 2026, a load of electronics left Compton, California, for El Paso. The driver showed an Illinois license in the name of Rustam Mavlonov, again with an altered photo of Khaydarov. Before pickup, the carrier on that load sent the broker a photo of the truck’s plate. It was AT903S. Ten days later, the conspirators used that same carrier’s email account to send a broker in Connecticut a W-9 in the former owner’s name, dated Feb. 9, 2025, with what was presented as the owner’s signature. The owner no longer had any interest in the company. The email was signed “Robert.” That carrier’s email account was later logged into from Connecticut IP addresses on March 13 and March 31, which is how this case ended up in New Haven.
On Feb. 20, 2026, the Mavlonov license picked up a load of nicotine pouches in Fullerton, California, bound for Shepherdsville, Kentucky. It was the brand’s entire stock for a product launch, two flavors that weren’t on sale anywhere yet. Within days, a client told the brand that a wholesale warehouse in West Haven, Connecticut, was offering those exact flavors. Some of the freight was later recovered at a warehouse in California.
On March 18, the driver at a pickup in City of Industry, California, showed a Nevada license in the name of Dmitri Aganin. On April 3, the Aganin license picked up a load of disk drives in Laredo, Texas, headed for Milpitas, California. On April 22, a pickup in Tucson, Arizona, was reported stolen, and the FBI’s location warrant put Khaydarov’s phone at that site that day. On April 28 and 29, a driver picked up a load headed for El Paso in San Diego and showed an Ohio license in the name of Nurtas Kairat. The photo on that one wasn’t Khaydarov. His phone was there anyway. The carrier on that load told the broker the truck was in Arizona, then said it was back in San Diego and the driver wanted to return the load. The driver went back to the shipper, left before the trailer was unloaded and stopped answering.
The driver never had to hide from the government. He held a valid New Jersey Class A commercial driver’s license the entire time. The affidavit says the cryptocurrency account he was paid through, about $120,996 across 33 transactions from Nov. 29, 2025, to May 8, 2026, was opened at Coinbase in his real name with his real license and a photo of his real face. The fake identity only had to fool one person: the one at the dock door.
The truck broke the case. On April 9, the FBI tracked Khaydarov’s phone to a truck stop near North Las Vegas and found a white 2017 Volvo tractor and a 53-foot trailer wearing New Jersey plate AT903S. The tractor carried a placard with another motor carrier’s name, MC number and USDOT number. Police had reported that carrier several times in March and April for picking up loads that were later reported stolen.
On May 18, police in Ontario, California, got an alert on a plate flagged in law enforcement systems for suspected cargo theft. The plate was on the trailer, and the officer said it looked counterfeit. They stopped the truck. The driver handed over a New Jersey CDL in his real name. He told the officer the truck was his, had been for three years, and that no one else drove it. He consented to a search. In the cab the officer found what appeared to be a counterfeit Pennsylvania driver’s license and a can of one of the nicotine flavors stolen in Fullerton. Khaydarov said his boss had given him the license that day and told him to keep it in the truck. He didn’t admit to anything.
When the FBI searched the tractor on May 28, it was wearing its real plate, New Jersey AW494L. The VIN was 4V4NC9EH4HN954902. It was registered to Fast Way UZB Trans Inc, a New York company for which state business records list Khaydarov as registered agent. Agents also found bills of lading for loads in the case and the hats he’d been photographed wearing at three of the pickups. The FBI’s theory is simple: AT903S went on for the pickups, AW494L went back on for everything else. The indictment adds that the conspirators used burner phone numbers and encrypted messaging, and that they defeated the electronic tracking the victims had placed on the loads.
The case also shows that the Volvo had a long federal history before the first theft, and none of it was under its own carrier. In FMCSA’s crash and inspection records, VIN 4V4NC9EH4HN954902 shows up under four different USDOT numbers in five states over six years, on two different New Jersey plates. On Oct. 9, 2019, at 7:10 a.m., it was in a tow-away crash with no injuries, westbound on Interstate 80 at mile marker 47 in Iowa, wearing New Jersey plate AW643D and running under Trust Line Transportation LLC of Aurora, Illinois, USDOT 2906347, whose listed officer is Ravshan Abdurakhmanov. By April 23, 2024, it had a new New Jersey plate, AW494L, and was inspected in Idaho under Bek Logistics LLC of Akron, Ohio, USDOT 3923883, a carrier that reports one truck and lists Mirzaabror Komilov as its officer. It also shows up under Zam Zam Freight LLC of Denver, USDOT 3529352, a 28-truck carrier whose listed officer is Yussul M. Sultygov. On Jan 30, 2025, Arizona inspectors put it out of service under Tamerlane Express Inc. of Naperville, Illinois, USDOT 3302117, a carrier that reports 90 power units and lists Nodirbek Roziev as its officer and Illinois registered agent. On June 23, 2025, it was inspected again under Tamerlane in Tremont, Mississippi, hauling a load the report lists for Biomerics. Nothing in the court record mentions any of those four carriers or accuses them of anything, and an owner-operator leasing his truck onto one carrier after another is ordinary in this business. The point is narrower. Less than three months before the Swedesboro pickup, the truck that would carry the case was on the road under somebody else’s number, as it had been for six years. A VIN check at the dock shows you every USDOT number a truck has run under. A bill of lading doesn’t.
The affidavit names Artan Transportation LLC as the carrier on the first theft but gives no USDOT number, and it’s a crowded name. FMCSA lists an Artan Transportation LLC, USDOT 3689304, MC 1286430, at a mailbox at 2136 Ford Parkway in St. Paul, Minnesota. It reports one power unit and one driver. Its USDOT number is still active, but its for-hire authority is now inactive. Federal inspection records show six different VINs inspected under that number between June 4 and July 23, 2025, in Louisiana, West Virginia, Missouri, North Carolina and Tennessee. One declared truck, six trucks on the road. The inspections stopped after July, and the carrier filed an MCS-150 update on Aug. 13, 2025, a month before Swedesboro. FMCSA lists Mohamed Abdi as the carrier’s officer. Minnesota’s business registry shows an Artan Transportation LLC formed at that same mailbox on Dec. 31, 2024, with Mohamed Abdi as organizer and Yulia Morozova as registered agent, and a mailing address at 1433 Amberglen Circle in Shakopee, Minnesota. It filed a change of registered office or agent on April 18, 2025, filed an amendment on Nov. 6, 2025, and was administratively terminated on Jan. 26, 2026. In Ohio, two more companies named Artan Transportation LLC were formed in 2025 by two different people. The first, organized May 19 by Elnora Ismailova with Registered Agents Inc. as its agent, the state canceled on June 24. The second was organized Sept. 10, four days before the Swedesboro pickup, by Jamilbek Nigmatullaev, who also served as its agent. He resigned as agent Sept. 15, and the state canceled the company two days later for failing to keep one. The court record doesn’t say which Artan, if any, the FBI meant, and nothing here should be read as saying it is one of them. But a carrier name that keeps getting formed and dropped in different states by different people, next to a mailbox USDOT number with one declared truck and six on the road, is exactly what a pre-load check should flag for a broker.
This isn’t one bad truck. I ran the same check nationwide. Over the 12 months ending Oct. 31, 2026, roadside inspectors recorded 1,617,620 distinct VINs. Of those, 61,299 were inspected under two or more USDOT numbers, and 6,354 under three or more. On 1,442 occasions, the same VIN was inspected under two different USDOT numbers on the same day. And 7,183 license plates were recorded on two or more different VINs in the same state.
Most of that has an honest explanation. Owner-operators lease onto carriers and move between them. Trucks get sold. Plates get transferred. Inspectors make typos. A VIN that shows up under two numbers is a question, not a verdict. But it’s a question a broker or shipper can ask before the load moves, not after it disappears.
The other half of these schemes is the fence. A separate sealed indictment in the Southern District of New York, United States v. Nuriddinov, No. 26-cr-455, returned Sept. 30, 2026, charges Asliddin Nuriddinov and Shakhram Khaydarov with conspiring from July 2025 through April 2026 to transport and possess goods stolen from commercial trucks. The overt acts read like a dispatcher’s day: coordinating delivery of stolen merchandise, discussing the risks drivers face hauling stolen loads and the prospect of paying bail if they’re arrested, getting payment for a driver, and trying to sell stolen perfume and handbags. Nothing in either filing connects the New York case to the Connecticut one, and the shared surname is common. I’m not suggesting a link. I’m showing you both ends of the business: the driver who picks up the load and the people who pay the driver and move the goods.
The handoff at the dock. Almost nothing. A carrier must ensure its drivers are qualified under 49 CFR Part 391. A broker has to hold authority and a bond. No federal rule requires a shipper or broker to confirm, at pickup, that the person signing for the freight is the driver the carrier assigned, or that the truck at the door belongs to the carrier on the rate confirmation. A paper bill of lading is a receipt, not an identity check.
The liability side is moving faster than the rules. On May 14, 2026, the Supreme Court ruled 9-0 in Montgomery v. Caribe Transport II, LLC, No. 24-1238, that the FAAAA doesn’t preempt state-law negligent hiring claims against freight brokers. That case is about a crash, not a theft. But it tells every broker that courts will look at what was checked and when. Cargo underwriters are already asking the same question at renewal.
So here’s where it could have been stopped. I’m going to use the system I built to do that, so you know my interest up front: I founded Tea Technologies, which builds THE TEA, LoadVerifi and Araynge. Every check below works the same way, whoever runs it, and you can ask the questions yourself. I built
to ask them at the dock, load by load, because that’s where this case says the industry is blind.
The first lie in this scheme is the carrier. The thieves don’t fake a company anymore. They buy one or break into one. So the carrier check can’t stop at “authority active, insurance on file.” THE TEA pulls every change a carrier has made to its MCS-150 filing, with the old and new values side by side, along with gaps in its authority, the VINs it has run that other USDOT numbers also ran, and where its trucks have actually been inspected. A new officer, a new email and phone, and a new set of trucks in the same quarter is what a purchased authority looks like on paper. LoadVerifi runs those signals at carrier assignment, checks live authority and out-of-service status with FMCSA in real time, and confirms active liability insurance. It reads the carrier’s certificate of insurance, compares it against the insurance filings FMCSA has on record, and emails the agent listed on the certificate to confirm it. A carrier account in LoadVerifi doesn’t activate because someone clicks approve. It activates on proof of control of the USDOT number, from officer-level identity checks or a verified claim.
Our freight network and load board use the same gate in the other direction. Anyone can join and post road reports, but posting, quoting, or booking a load requires a verified identity, and claiming a business requires a one-time code sent to the contact on the company’s FMCSA filing plus a Persona identity check. One check covers both sides: a driver who verified on Araynge can reuse that identity check in LoadVerifi instead of paying for a second one.
The second lie is the driver. Five licenses, one face. Here’s what matters: a face match alone wouldn’t have caught him. The Makhmudarov and Mavlonov licenses had his photo on them. His face matched every time. What didn’t match was the license itself, and the carrier. Illinois told the FBI the Makhmudarov license number had never been issued. A check against the issuing state’s own records catches that at the dock, months before it shows up in an affidavit.
LoadVerifi’s Dock Check puts a QR code on the bill of lading. The code holds no names and no driver list, because a bill of lading gets photographed, faxed and left in cabs, and a printed list just tells a thief whose name to use. When the shipping clerk scans it, the driver verifies his identity right there with Persona: the government ID is checked for authenticity and against the issuing state’s records, and a live selfie is matched to the face on it. Then LoadVerifi checks him against that carrier’s roster of pre-cleared drivers in CarrierVerifi and against what this load requires. The clerk sees green or red, the driver’s first name and last initial, and the carrier. The clerk never sees the driver’s records. If the driver is cleared but isn’t the one assigned to the load, the carrier has 15 minutes to confirm him from its phone. If there’s no answer, the screen goes red and the broker gets an alert. A driver showing up under a carrier he isn’t on the roster for turns red and sends the broker the other carrier’s USDOT number.
“Dmitri Aganin” has to produce a Nevada license that Nevada’s own records say exists, with his face on it, then has to be on the roster of the carrier the broker booked, then the real carrier has to say yes. The thief has to beat all three, live, at 1 a.m.
The third lie is the truck. The FBI says AT903S went on for pickups and AW494L went on for everything else. At the dock, LoadVerifi’s truck check takes a live-camera photo of the tractor plate, reads it, and matches it against the booked carrier’s equipment list and the trucks its ELD provider reports through Terminal, a telematics connection the carrier authorizes. If the carrier has connected its ELD, the truck’s last GPS ping has to be within about 25 kilometers of the pickup and less than 30 minutes old. When a VIN is captured, it gets the full workup: the check digit (a fabricated VIN usually fails position 9), an NHTSA decode of make and model against what’s sitting at the door, every USDOT number that VIN has been inspected under, any other VINs seen wearing that plate, and live authority for the carrier. A plate that doesn’t belong to the booked carrier turns the clerk’s screen red: “Truck doesn’t match the carrier on this load.”
Then comes the question nobody at a dock door can answer from memory: who are this driver and this truck actually tied to? A rate confirmation tells you who you booked. It doesn’t tell you who you’re handing the freight to, what equipment it’s leaving on, or who stands behind either one. So LoadVerifi runs the driver and the truck against other systems and agency data before the load moves. LoadVerifi checks the driver against the booked carrier’s roster and drivers verified across our systems, and if a driver turns up tied to a different carrier, the broker is sent that carrier’s USDOT number. The truck is checked against federal inspection, crash and authority records: which carriers have run that VIN, which plates it has worn, which other trucks have worn its plate.
Then walks out from those carriers to the officers, addresses, phone numbers, email accounts, and equipment they share with anyone else.
Run the Volvo. The company it’s registered to, Fast Way UZB Trans Inc, was incorporated in New York on March 28, 2019, at an apartment on Ocean Avenue in Brooklyn, with Khaydarov listed as the agent for service of process. It registered in New Jersey as an out-of-state corporation that June, four months before the Iowa crash. It has never held a USDOT number of its own, and no registered carrier lists Khaydarov as an officer. Its truck has spent six years under other companies’ authority: four in federal records, and in 2026 under another carrier’s placard at a North Las Vegas truck stop. The plate the FBI says was used in the thefts, AT903S, doesn’t appear in a single federal inspection or crash record. A plate that has never been in front of an inspector, on a truck that has never had its own carrier, answers the question before the clerk ever signs. The FBI got there with cell-site warrants and months of surveillance. The broker gets it before the load is tendered, and the clerk gets green or red at the door.
The fourth lie is the trip. The indictment says the conspirators defeated the victims’ tracking. That’s the honest limit of tracking: anything a driver controls, a driver can switch off or fake. That’s why LoadVerifi pulls location from the carrier’s ELD connection rather than a phone app, and why it treats every stop as a question. Stops are recorded with how long the truck sat, the nearest facility and whether it’s secured, and the nearest reported incident. Every pickup, stop, relay, transload and delivery is planned and approved in advance, with the drivers allowed on each leg. Adding a relay or transload mid-route requires the approver to re-enter a password. At delivery, LoadVerifi re-hashes every evidence photo, checks that it was taken live with the camera, and compares the VIN, the truck and trailer plates and the seal from pickup against delivery.
The fifth lie is the paper trail. The W-9 in a former owner’s name. The emailed excuse about a delay. The carrier telling the broker the truck was in Arizona when it was in San Diego. Every event in a LoadVerifi load is written to a chain of custody, where each record carries a SHA-256 hash of the one before it. Change one record after the fact and the chain breaks where anyone can see it. Personal data stays off the chain; only hashes and result codes go on it. If a load does go missing, the broker, the shipper and the insurer start with a record of who was verified, which truck was at the door, where it was last seen and who approved every change, instead of a stack of emails from an account the thief controlled.
Before the load is ever tendered, the lane matters too. LoadVerifi’s lane risk check runs the route county by county: FMCSA truck crash rates per truck-mile, and FBI-reported cargo thefts in the counties the route crosses. Araynge and TruckVerifi read the same figures. A load of copper leaving the Inland Empire over a holiday weekend is a different risk than the same load leaving Tuesday afternoon from Ohio, and the price and the controls should reflect that.
No system stops every theft. A real driver with a real CDL, in his own truck, working for a carrier he really controls, can still drive off with a load. These checks make every lie in the Khaydarov playbook cost a step, at the one place in the chain where the person and the truck are actually standing in front of somebody.
CargoNet’s outlook for the fourth quarter is the same every year, because the pattern is: theft rises in the fourth quarter and early in the new year, and holiday closures and short staffing give thieves room to work. If you’re a shipper, scan the driver, not the paperwork, and check the plate on the tractor against the carrier on the rate confirmation. If you’re a broker, look at when the carrier last changed its MCS-150, who its officers are now, and which other USDOT numbers its trucks have run under. Never take a change of contact information by email. Make the carrier confirm the driver. If you’re a carrier, put your drivers on a roster before somebody else puts their name on a fake license. If you’re an insurer, ask your insureds what they checked at the dock, not just at the tender.
Somewhere in Swedesboro, a shipping clerk handed over a load a little after 1 a.m. on a Sunday in September to a driver with a valid license, a real name and a truck with a federal inspection history. Everything about him checked out, because nobody checked.
The bill of lading was supposed to prove who took the freight. In this case, it only proved somebody did.