Freight fraud · 7 min read
Jakub Wujec
Last reviewed: 16 June 2026
New carrier email domain risk signals before you assign the load
A new carrier email domain registered weeks ago while KRS or CEIDG shows a ten-year-old sp. z o.o. is a risk signal that requires review. Young domains are common after rebrands, but they are also common in impersonation. Compare domain registration date, register company age, and booking contact on the same day. It does not prove fraud by itself.
Key checks before you assign the load
- RDAP/WHOIS domain registration date versus company incorporation in the register, when the registry publishes a creation date.
- Whether the new domain replaced an older domain the carrier used on past loads.
- Website content: real fleet photos, address, and phone matching the register.
- Invoice and VAT name still tied to the same legal entity after the domain change.
- Confirm the domain change through an independently found or previously confirmed contact channel.
- Licence and insurance still valid on the entity you contract with, not a new shell.
Quick triage before you assign the load
A young domain is not automatically fraud, but it earns a same-day review before pickup.
Step 1: Check the domain creation date via RDAP or registry
Compare the creation date with the company incorporation date in the register when the registry publishes one. Prefer RDAP first. When the date is unavailable, use historical signals: passive DNS first seen, MX history, Certificate Transparency, first website versions, or earlier domain activity.
Step 2: Ask whether the domain replaced an older one
Check past load records for the previous domain the carrier used, and ask directly why it changed.
Step 3: Compare the new website content to the register
Look for real fleet photos, an address, and public contact details that match the register entry when published, not a template or parked page.
Step 4: Confirm via an independent contact channel, not the new signature
Use an independently found or previously confirmed contact channel: public contact from CEIDG or the transport register, the company website, a CRM contact, or a number confirmed on earlier loads. Do not rely only on the number in the suspicious email.
If the load is already moving
- Call the old known contact number as well as the new one to confirm who authorized the domain change.
- Request a GPS or tracking link straight from the vehicle.
- Freeze payment until domain age and register age are reconciled.
- Escalate internally to your fraud or compliance contact before releasing further loads.
- File a police report if you suspect the domain change was used to divert cargo or payment.
What not to rely on
- Assuming every new domain is fraud; startups and rebrands happen.
- Assuming WHOIS privacy hid the creation date. Privacy usually hides owner contacts; missing creation dates more often come from registry or ccTLD policy.
- Old email threads forwarded from a colleague as proof the domain is safe.
- A LinkedIn profile created the same week as the domain.
- Carrier claim that IT is "still building" the site with no independently confirmed contact check.
- Checking domain only after you already sent the pickup address.
Why this risk signal matters and what it does not prove
A new carrier email domain is cheap to create. Registers and licences are harder to fake at scale, so fraud flows through fresh contact channels.
- Domain age mismatch with register age may indicate impersonation of a mature haulier.
- Legitimate rebrands usually show parallel updates in invoice, VAT, and register filings.
- Treat a very recent non-freemail domain as a stronger signal than freemail on a sole trader.
- One info flag on registration date should trigger review, not automatic load approval.
Red flags and common mistakes
Domain registered in the last few months
A recently registered domain is a review signal. Pair it with register age before you treat it as innocent rebranding.
New domain plus recent board or shareholder change
May indicate takeover or impersonation after ownership movement. Requires review, not automatic rejection.
Parked page or template site on an active licence
Risk signal when the operator claims established operations but the site is empty.
New domain with country mismatch to VAT registration
Domain country versus VAT country is a very weak signal. Could be a foreign parent company. Still confirm contact before high-value cargo moves.
Urgent lane paired with "we moved to a new website"
Pressure plus contact change is a pattern worth escalating internally.
When you want domain and register checks in one place
Domain analysis uses RDAP and WHOIS registration data and compares domain age with company register age when a creation date is available. Very young domains may need manual review.
- Compare domain registration with company age from KRS, CEIDG, ANAF, or ARES in one run.
- Parked or placeholder website on an active licence.
- Registration-country mismatch with carrier VAT country when published.
- PDF report documents domain signals next to register extracts for audit trails.
Certica
Don't want to do this on every booking?
Certica pulls data from the same registers, checks it, and shows a clear result: what is OK, and what needs clarifying before loading.
Official sources
FAQ
How new is suspicious for a carrier email domain?
There is no universal cutoff. Compare domain age with register age. Treat a young domain on an old register entry as a review item, not proof of fraud.
Can a rebranded carrier use a new domain safely?
Yes, with evidence: updated register filings, VAT whitelist bank accounts, licence continuity, and confirmation through a known director or previously confirmed contact channel.
Does a new domain always mean new domain carrier fraud?
No. It is a risk signal. Combine with licence, VAT, insurance, and lookalike checks before you decide.
What if the domain registration date is unavailable?
Some registries and ccTLDs do not publish a convenient creation date. Prefer RDAP first. When the date is still missing, use historical signals: passive DNS first seen, MX history, Certificate Transparency, first website versions, or earlier domain activity. Also confirm contact through an independently found channel and review website content, invoice continuity, and licence data before approval.