Cargo theft: Why cargo theft often begins weeks before a trailer disappears

A truck stop on the A4 near Cologne, in the middle of the night. A guard sees a loaded semi-trailer still parked in a spot late in the evening. The next morning, it’s gone. No lock picked, no witnesses, no panic. Just an empty parking space and a police report.

I have described exactly such cases in my thought experiment “What if someone attacks our supply chains?” , albeit from a very abstract perspective: What happens when someone does not attack the goods themselves, but rather the trust upon which our entire supply system relies? Cargo theft is precisely that. Just not as a thought experiment, but as a daily reality at German rest stops and in digital freight exchanges.

I have already reported extensively on a very concrete case from Cologne, where a forwarder with a hidden GPS tracker was able to expose a gang of so-called phantom carriers. This time, it is not about that single case, but about something that is almost always overlooked in the reporting: the groundwork. Because no semi-trailer simply disappears, and no fraudster simply gets handed over a load. Both require preparation. Only this preparation looks very different today, depending on whether the perpetrators are standing at the yard or sitting at the screen.

The Old School: Observe, Conceal, Strike

The Federal Association of Freight Transport, Logistics and Waste Management (BGL) has been warning for years that classic cargo theft is rarely a matter of chance. Even police crime prevention states it unequivocally: The crimes are well-planned; sometimes entire semi-trailer combinations are stolen, and not infrequently the perpetrators are even involved in the transport chain. They contribute by passing on information or by specifically scouting and investigating targets and locations.¹

This aligns with what the Federal Office for Logistics and Mobility (formerly the Federal Motor Transport Authority) documented years ago in its special report on thefts in the transport sector: organized gangs that specifically search for inadequately secured vehicles, types of cargo, and parking spots.²

In practice, this means: Before a tarpaulin is even slit or a trailer uncoupled, the perpetrators already know what they are looking for. Which truck stop is poorly lit. Which weekends are staffed with only a single plant security officer. Which vehicles regularly transport high-value goods. This information does not fall from the sky; it is collected, sometimes over weeks.

A Personal Experience from My Time at DHL Freight

I experienced this myself when I was still operating as a subcontractor for DHL Freight. During that time, perpetrators managed to steal two complete trailers full of televisions from the company premises on a weekend. Precisely on a weekend when only plant security was on site.

What was remarkable was not just the timing. The perpetrators presented themselves with all the identifying features of a genuine subcontractor: vehicles, markings, demeanor – everything seemed completely plausible at first glance. No one from plant security had any reason to be suspicious. That is exactly the point: The actual performance of the perpetrators did not consist in the theft itself, but in the concealment that made this theft possible in the first place. Whoever knows how a subcontractor typically behaves, what documents they present, and how the process works at the ramp can almost unnoticed slip into an existing structure.

I was also personally targeted with a slit tarpaulin during that time. When I left my truck standing overnight at DHL in Menden, the perpetrators set about slitting the tarpaulin and stole 6 pallets of the then newly released Xbox One. Right there on the DHL parking lot.

The New School: Groundwork at the Screen

While security personnel, cameras, and attentive drivers still stand in the way at truck stops, a second path for preparation has become established that requires no physical presence: access to digital credentials.

Since September 2025, an attack wave has been active in which criminals have specifically registered fake domains to compromise the identities of freight forwarders, freight exchanges, and logistics service providers. According to current findings, over 1,600 unique login credentials for important industry platforms have already been stolen, including fleet management systems, freight exchanges, and payment services.³ Whoever possesses valid but stolen login credentials does not need to bypass a firewall. They simply log in, as if they were the legitimate user.

I also have corresponding indications from my own network at hand. Several freight forwarders have independently reported to me over the past weeks that there is an increased attempt to obtain access credentials for freight exchange accounts or confidential shipment data via phishing emails or targeted identity theft. For understandable reasons, the affected companies do not wish to be named here, but the frequency of such reports is remarkable and aligns with what is also observed regionally.

This groundwork differs fundamentally from the physical scouting of a truck stop. No one needs to drive around at night taking photos of parking spots. It is enough to send a convincing email and wait until someone clicks on a link or enters login credentials into a fake login mask.

Why Freight Exchanges Become the Preferred Target

Freight exchanges such as TIMOCOM, Trans.eu, or Teleroute are indispensable for the industry, precisely because cargo and space come together there in seconds. However, this very speed also makes them attractive to scammers.

In this regard, I sent an email to TIMOCOM, Trans.eu, and Teleroute. By the editorial deadline, only TIMOCOM had responded so far among the three platforms.

In an email response, a representative from TIMOCOM pointed out the complexity of the problem.

“The perpetrators are acting increasingly professionally and combine classic fraud schemes with cybercrime, such as phishing or identity theft,” explained Lisa Schneider, Marketing Communications Manager at TIMOCOM.

“In our view, this risk can only be reduced collectively,” she added. TIMOCOM itself emphasizes that platform operators, freight forwarders, carriers, and shippers each must take responsibility for consistently implementing security measures and reporting suspicious activities early on.

In this context, TIMOCOM refers to a multi-stage security concept as well as investments in prevention and education. As a concrete example, the spokesperson cited an eLearning module that was recently developed jointly with Spedifort and the Schunck Group.

As soon as I receive responses from further platforms such as Trans.eu or Teleroute, I will add them here.

Two Paths, One Principle

Although the Autohof in Cologne and a phished freight exchange may seem so different at first glance, both follow the same basic principle: Whoever wants to steal successfully does not reach for the goods first. They gain access first, either through a convincing disguise on-site or by stealing login credentials on the screen.

That is exactly what I suspected in my thought experiment on supply chain attacks: that modern logistics does not live primarily from fences and locks, but from trust. Trust that a subcontractor is indeed who they claim to be. Trust that an email really comes from the freight exchange. This very trust is the actual vulnerability that organized gangs and phantom carriers exploit equally.

For freight forwarders, this means: Security does not stop at the barrier or the camera. It begins with the question of how well a company is able to verify trust before granting it. For us drivers, it mainly means one thing: Attention remains a weapon even when the actual crime no longer starts on the depot yard but in an inbox.

Sources and Further Information

• My article: What if someone attacks our supply chains?
• My article: Phantom carriers: When the goods disappear completely legally