What to Do After Cargo Theft

How this comes up in practice

In the first hour after suspected cargo theft, evidence that exists now may not exist later. Load board profiles are edited or deleted. Email threads go offline. Phone numbers stop routing. The file assembled in that first hour is what every subsequent process — claims, law enforcement, official reporting — depends on. Preservation runs parallel to notification rather than coming after it. The sequence that produces the most usable incident file: lock and preserve every unmodified transaction record first, then attempt contact with the carrier through every known channel and document each attempt with a timestamp, then notify the shipper and receiver, then contact law enforcement and the insurer. Each contact generates a record; the earlier those records are created, the more complete the file available for claims counsel and official reporting channels.

The sequence that makes an incident file usable

After a cargo theft, the file assembled in the first few hours determines what every subsequent process — law enforcement, insurance claims, official reports, legal review — has to work with. That file's quality is set in the immediate window after discovery, not at the time each process formally begins. For adjacent verification steps, compare this with Cargo Theft Prevention Checklist, How to Report Freight Fraud, and FTC / FBI IC3 / OIG Reporting Checklist.

The sequence matters because some actions preserve evidence while others can compromise it. Notifying parties before preserving communication thread screenshots can allow edits. Filing a complaint before capturing email headers in their original format may make the technical data investigators use unavailable. This guide follows a preserve-then-notify order because the direction is irreversible: records overwritten or deleted before documentation can't be recovered.

Law enforcement, insurers, and official reporting channels all ask for documentation that proves what the transaction was supposed to look like. The rate confirmation, carrier assignment, official lookup records, and communication trail assembled at the beginning of the incident are what answers those questions. Assembling them before any notification goes out is the most useful use of the first hour.

Preserving the record and notifying the right parties after suspected theft

The first hours after suspected cargo theft matter because evidence disappears quickly. Load board postings get edited, profiles get deleted, email threads disappear, and phone numbers go silent. Preservation runs parallel to notifications — not after them — because some of what you'll need for reporting or claims may not be available if you wait.

Official reporting doesn't replace internal escalation, insurer notification, and law enforcement contact. Each channel serves a different function, and the documentation assembled in the first few hours supports all of them. The sequence matters: preserve records first, then notify the parties who need to act on them.

Records to lock down immediately after discovering suspected theft

Use the same identifiers across every record. Small differences can be clerical, but they should be resolved before pickup, dispatch, or payment.

If a detail is missing, ask for the missing record rather than filling the gap from memory, an old packet, or a search result.

What to preserve before the first notification goes out

Save records in their original format when possible. Use one folder named with the load number, lane, date, and parties involved.

If a dispute, identity concern, or theft concern appears later, the timeline is easier to reconstruct when emails, PDFs, screenshots, call notes, and lookup results are grouped together.

Questions that establish what happened and who was involved

Questions should be specific and tied to records. That keeps the conversation professional and avoids unsupported accusations.

If an answer changes the transaction, document the person, date, time, and channel used to confirm it.

What a law enforcement report doesn't replace in the documentation file

One detail checking out is not the same as authorization confirmed. A correct number, a recognized company name, or a well-formatted document can each appear in a transaction where the communicating party has no connection to the registered entity.

A warning sign is a reason to document and verify, not a finding. Record what prompted the concern and what check it led to — that record determines whether the situation can be addressed if it escalates.

When the sequence of steps matters as much as completing each one

When the file still has gaps, slow the transaction enough to preserve the record and move the question to the right channel.

That may mean a direct call-back, a shipper or receiver confirmation, an internal escalation, an insurer or claims contact, or an official complaint or reporting resource where appropriate.

Source Notes

FAQ