Freight fraud · 7 min read
Jakub Wujec
Fake carrier emails and suspicious domains to review before pickup
Fake carrier email threads often use freemail, disposable domains, invisible characters in the address, or a domain that does not match the company name in KRS or CEIDG. Compare the booking email to registry data and WHOIS on the same day you approve the load. A suspicious carrier domain is a risk signal that requires review, not proof of fraud by itself.
Based on Certica checks
Across supported registers, checks that most often need human review before load assignment are email and domain mismatches, domains registered recently compared with company age, management or ownership changes in the company register, and transport licence scope that does not fit the booked lane.
These are risk signals, not proof of fraud. They explain why a clean company register line alone is not carrier verification.
Key checks before you assign the load
- Read the full email address, including dots, hyphens, and non-Latin characters.
- Check whether the domain is freemail, disposable, or recently registered.
- Compare domain core tokens with the legal name from the company register.
- Open the carrier website and check if it matches register address and phone.
- Call a number from the register, not only the signature in the email.
- Run the same contact pass when a known carrier switches to a new domain.
What not to rely on
- Display name in Outlook or Gmail showing a known carrier brand.
- A PDF letterhead that matches the email signature.
- Previous loads with the same display name but a different domain.
- WHOIS privacy without comparing register address and phone.
- A website that copied logos but uses a different invoice entity.
- Assuming IT will catch spoofing after you already shared pickup info.
Why this risk signal matters and what it does not prove
Company existence alone is not carrier verification. A company can exist and still need deeper checks before you assign a load.
Carrier email spoofing targets operations teams, not IT. The inbox is where pickup addresses and cargo values leak first.
- A suspicious carrier domain plus clean register data may still mean impersonation of a real haulier.
- Freemail on a small sole trader can be normal; on a sp. z o.o. with ten trucks it is a stronger signal.
- Email alone never proves fraud. Combine with licence, VAT, and insurance checks.
- Clearing a domain mismatch with a register callback is faster than recovering cargo after pickup.
Red flags and common mistakes
Invisible or homoglyph characters in the email
May indicate spoofing aimed at looking like a trusted domain. Requires review before you reply with cargo details.
Disposable or suspicious TLD
Risk signal on a carrier that claims a long operating history. Check register age against domain registration.
IDN punycode domain close to a real carrier brand
Lookalike domains are a common impersonation path. Compare with the legal name in the register.
Freemail on a fleet operator story
Gmail or similar on a company with dozens of trucks may indicate a broker or fake identity. Not proof alone, but worth a callback.
Email domain country mismatch with carrier VAT country
May be legitimate for international groups. Still requires review when pickup is imminent.
How Certica checks carrier email and domain risk signals
Certica automatically collects and analyses carrier verification data, detects risk signals, and supports your decision before a load is assigned.
Every verification run includes contact and domain analysis alongside VIES and national registers.
- Booking email compared with register company data.
- Domain and website checked against register address and legal name.
- VAT and licence checked on the VAT ID you enter, not the display name in email.
Official sources
- EU VIES VAT validation (European Commission)
- Polish National Court Register (KRS)
- Polish CEIDG sole trader register
- Polish KREPTD transport register (GITD)
- Polish court filings register (RAR)
- Romanian ANAF VAT payer register
- Romanian ONRC insolvency bulletin (BPI)
- Romanian road transport licences (ARR)
- Romanian RCA insurance database (AIDA)
- Czech ARES business register
- Bulgarian Road Transport Agency (RTA)
- Latvian open government data portal
FAQ
What makes a carrier email suspicious?
Freemail on a fleet operator, disposable domain, invisible characters, lookalike spelling, or a domain registered last week while KRS shows a ten-year-old company. Each is a risk signal, not automatic fraud.
How do I check a suspicious carrier domain quickly?
Compare WHOIS registration date, website content, and domain with the company register extract on booking day. Certica runs those checks in the same pass as VAT and licence data.
Is Gmail always a fake carrier email?
No. Sole traders sometimes use freemail. The signal is stronger when register data shows a limited company, community licence, and multiple vehicles.
What should I do after a domain warning?
Call the number from the register, confirm the booking contact, and hold pickup details until the mismatch is explained or cleared.
Related pages
Certica
Run the same checks automatically
Certica collects registry, VAT, licence, insurance, and domain data in one run, applies risk rules, and saves a PDF audit trail before you assign the load.
No card required. Results usually return in seconds to a few minutes, depending on registry availability.