The Threat Is Moving Upstream: Identity Fraud, Cargo Diversion and Coordinated ORC Demand a Unified Response

By Commander Michael Ware | September 6, 2026

The Threat Is Moving Upstream: Identity Fraud, Cargo Diversion and Coordinated ORC Demand a Unified Response

The past week reinforced a point that law enforcement, retailers and the transportation industry can no longer afford to overlook: organized retail crime and cargo theft are increasingly parts of the same broader criminal ecosystem. The traditional picture of cargo theft—a trailer disappearing from an unsecured lot—or retail theft—a group running merchandise out of a storefront—does not fully describe the threat we are facing.

Today’s criminal organizations are exploiting transportation systems, legitimate business credentials, digital communications, freight-broker relationships and weaknesses in identity verification. At the same time, investigators are increasingly required to follow merchandise across city, county and state lines.

For law enforcement and private-sector security professionals, our response must evolve at the same pace.

Labor Day Creates a Critical Cargo-Theft Window

On September 4, Verisk CargoNet released a timely Labor Day cargo-theft advisory based on 273 incidents occurring during Labor Day periods from 2021 through 2025.

The numbers deserve attention. Incidents increased from 33 in 2021 to 56 in 2025, while 2024 reached 70 incidents. California, Texas and Illinois accounted for approximately 48% of the incidents analyzed. Even more important operationally, 71% occurred on the Thursday, Friday, Tuesday and Wednesday surrounding Labor Day—not during the holiday weekend itself.

That finding should change how agencies and businesses think about holiday deployment.

The highest-risk period may not be when facilities are closed. It can be immediately before employees leave and immediately after operations restart, when freight volume increases, staffing changes and personnel are under pressure to move shipments quickly.

CargoNet also estimates that cargo-theft losses exceeded $359 million during the first six months of 2026, with an average stolen commodity value of approximately $341,518.

This is no longer simply a volume problem. It is increasingly a high-value targeting problem.

Criminals Are Attacking Identity, Not Just Freight

One of the most important developments this week came from outside traditional cargo-theft reporting.

On September 4, FreightWaves reported that the Federal Bureau of Investigation is investigating a dark-web service claiming access to approximately 153 million driver’s-license records, including records reportedly labeled as commercial driver’s licenses. Researchers warned that authentic identity images could potentially weaken freight-pickup verification systems.

This issue deserves immediate attention from the transportation industry.

A criminal possessing legitimate-looking identity documentation, compromised carrier credentials and detailed shipment information may appear to a warehouse employee to be an authorized driver.

CargoNet separately warned this week that organized groups are compromising carrier accounts, business telephone systems, email accounts and compliance-platform credentials. Criminals can then operate through communications that brokers and shippers ordinarily trust.

Possessing the correct information is no longer sufficient proof that someone is legitimate.

Companies should increasingly verify the person, vehicle, carrier, shipment and destination as separate components of the transaction.

The Pabst Theft Demonstrates the Fraudulent-Pickup Threat

A highly visible California case illustrates the problem.

Authorities continue investigating the August 17 disappearance of approximately 1,600 cases of beer from a Southern California distribution operation. Reports indicate fraudulent documentation or impersonation was used during the pickups.

The dollar amount—approximately $70,000—is significant, but the methodology is more important.

The offenders allegedly did not need to breach a warehouse or physically hijack a tractor-trailer. They convinced the supply chain to release the merchandise.

That distinction should be incorporated into cargo-theft training nationwide. Security cannot end at the fence surrounding a distribution center. Authentication must become part of cargo security.

Transportation companies should consider multiple verification layers for high-risk shipments: confirming drivers through previously established contacts, independently verifying last-minute routing changes, documenting tractor and trailer identifiers, using geofencing and shipment tracking, and escalating unexpected substitutions before releasing freight.

Fewer Cargo Thefts Can Still Mean Greater Losses

Another important trend continues to develop.

CargoNet documented 677 supply-chain theft incidents during the second quarter of 2026, a 26% decrease compared with Q2 2025. At first glance, that appears encouraging. But estimated losses increased to approximately $304.6 million, more than double the estimated $135.7 million recorded during Q2 2025.

Criminal organizations appear to be becoming more selective. Copper and other metals remain attractive, while enterprise computing hardware, networking components and other technology shipments can generate multimillion-dollar losses from a single successful theft.

That changes the risk calculation. A tractor-trailer that looks ordinary may contain millions of dollars in technology. Security decisions therefore cannot be based only on what the trailer looks like. Intelligence about the commodity, route, destination, dwell time and current theft trends must influence security planning.

Organized Retail Crime Shows What Coordinated Enforcement Can Accomplish

There was also significant ORC news this week.

On September 3, Government of California reported that state-supported efforts targeting organized retail theft have produced 35,907 arrests, 28,667 cases referred for prosecution and more than $293.4 million in recovered stolen merchandise since October 2023.

Whatever jurisdiction we work in, there is an important operational lesson in those numbers. ORC investigations become significantly stronger when agencies stop viewing thefts as isolated store incidents and begin identifying people, vehicles, fencing operations, online sellers, financial activity and cross-jurisdictional connections.

That requires intelligence. A $900 theft in one jurisdiction may appear insignificant when examined independently. Connect that offender to 40 similar incidents across multiple jurisdictions and the investigative picture changes completely.

That is why retailer reporting and private-sector intelligence are so important. Loss-prevention investigators frequently see patterns before law enforcement does because they have visibility across hundreds or thousands of stores. We need systems that allow that intelligence to move quickly and lawfully between retailers and investigators.

Federal Attention to ORC and Supply-Chain Crime Continues

The federal conversation surrounding organized retail and supply-chain crime also remains important.

The bipartisan Combating Organized Retail Crime Act (CORCA) passed the U.S. House earlier this year by a 348–60 vote. Among other provisions, the legislation would establish an Organized Retail and Supply Chain Crime Coordination Center intended to improve collaboration among federal, state and local law enforcement and private-sector partners.

That concept reflects what investigators working these cases already understand. Criminal organizations do not respect jurisdictional boundaries.

An offender can steal merchandise in Illinois, fence it in another state, move proceeds electronically and use fraudulent transportation credentials originating somewhere else entirely. Investigations must therefore become as connected as the offenders.

Technology Must Become a Force Multiplier

Technology continues to change both sides of this fight.

Criminal organizations are exploiting compromised email accounts, digital freight platforms, stolen identities and telecommunications systems. Law enforcement and industry must respond with technology that improves detection and attribution.

That includes GPS and covert cargo trackers, license-plate recognition, geofencing, RFID, trailer telematics, exception alerts, digital identity verification and analytics capable of identifying relationships between offenders, vehicles, locations and incidents.

But technology alone will never solve the problem. A tracker sitting inside stolen merchandise only becomes valuable when someone recognizes the alert, communicates that information quickly and has officers positioned to respond.

The real advantage comes from combining technology + intelligence + communication + operational capability.

What This Means for the Week Ahead

As we move through the Labor Day period, law enforcement agencies, retailers, carriers, brokers and distribution facilities should consider several immediate priorities:

• Extend heightened cargo security beyond Labor Day Monday. Historical data shows Tuesday and Wednesday remain significant theft days.

• Verify identity independently. Driver identification, carrier information and shipment documentation should be checked through trusted channels rather than information supplied solely by the person requesting the load.

• Treat routing changes as security events. Unexpected destination, telephone, email or delivery changes deserve secondary verification.

• Deploy tracking technology strategically. High-value and frequently targeted commodities should receive enhanced visibility.

• Connect retail cases across jurisdictions. Repeated suspects, vehicles, telephone numbers, online accounts and fencing locations should be treated as intelligence opportunities.

• Strengthen relationships before an incident occurs. Law enforcement should know the loss-prevention, cargo-security, railroad and logistics professionals operating within their jurisdictions.

Closing: We Cannot Fight Networks With Silos

The central lesson from this week is not simply that cargo theft or organized retail crime is increasing or decreasing. The more important development is how these crimes are evolving.

Organized groups are becoming more selective, more technologically capable and increasingly comfortable exploiting legitimate commercial systems. Our response must be equally sophisticated.

That means breaking down barriers between law enforcement and the private sector. It means sharing intelligence earlier. It means using technology proactively instead of only after a theft occurs. And it means recognizing that retail theft, cargo theft, fraud, fencing and illicit resale may represent different stages of the same criminal enterprise.

When retailers, transportation companies, railroads, prosecutors, technology providers and law-enforcement agencies combine their information, we stop responding to individual incidents and begin identifying the organizations behind them.

That is where prevention begins.

Commander Michael Ware

Law Enforcement | Organized Retail Crime | Cargo Theft | Supply Chain Security | Public-Private Partnerships