The anatomy of a double-brokering scam: the email tells that give it away

Double-brokering works because it looks like a normal load offer. Someone posts a legitimate load, a fraudster re-brokers it to you under a broker identity they do not own, and the money and the freight end up in the wrong hands. By the time anyone notices, the driver has already picked up.

We pulled every fraud report our customers filed over four months: 340 confirmed attempts across carrier fleets. The point of the exercise was narrow. Not the psychology, not the recovery process, just the email itself. What is actually different, on the message, between a real broker and a fake one?

Three signals did most of the work

Most attempts tripped on the same handful of tells. Ranked by how often they showed up in confirmed fraud versus a matched sample of legitimate offers:

• Domain age under 90 days. The lookalike domain (broker-logistics.co instead of the real .com) is usually registered days before the campaign. New domain plus a familiar-sounding name is the single strongest pairing we found.
• Reply-to that does not match the From. The display name says a broker you know; the reply-to routes to a Gmail or a fresh domain. Real brokers occasionally do this too, so on its own it is weak, but combined with a young domain it is close to decisive.
• Manufactured urgency. "Truck needs to roll in the next hour" and "send your MC and voided check to confirm" arrive together far more often in fraud than in real offers.

None of these is proof. Plenty of honest brokers use a new TLD or push a tight pickup window. The signal is in the stack: when two or three land on the same message, the odds shift hard.

What we changed in the product

Mailex now checks domain age and looks for lookalikes against the brokers you already have on file, and it does it before you hit send, not after. If a thread asks for your MC number or bank details and the sender fails those checks, you get a flag on the compose window rather than a report the next morning.

The fastest recovery is the one you never have to start. A flag on the reply screen beats a claim two weeks later.

Maya Brooks, Head of Risk

What to tell your dispatchers

The training that sticks is short. Slow down when a first-time sender asks for identity documents or payment details, check the domain against the broker you think you are talking to, and confirm the load through a channel you chose rather than the one in the email. That last step, calling the number on the broker packet instead of the number in the message, catches most of what the software misses.