Don’t fall for emails pretending to be FMCSA
Fraudulent emails are making their way into motor carrier in-boxes — again. The Federal Motor Carrier Safety Administration (FMCSA) warns motor carriers that a recent email asking for corporate documents is not from the agency.
The email uses several common phishing ploys, including:
- Requesting immediate action (or else), and
- Using an email appearing to originate from a legitimate party.
A phishing email is a fake email used to trick users into providing private information that could be used for identity theft (including corporate).
Tell-tale signs of phishing
This recent email uses an email address that implies it’s related to FMCSA, which it is not.
And the email’s subject line is meant to draw you in by stating, “Immediate Action Required: Submit Documents for FMCSA Compliance.”
Ironically, this fraudulent email is using cybersecurity to gain the confidence of the reader. The email tells the carrier that specific information is needed to ensure compliance and protect their information from potential fraud. They are instructed to reply with the following sensitive corporate information:
- Certificate of Insurance
- IRS-issued EIN Verification Letter
- Certificate of Organization
- Clear copies of your driver’s license (front and back)
The phishing expedition tries to illicit yet another emotional response from the recipient; the email cites 385.337(b) implying there is a safety audit within two business days and threatens penalties and fines for those who fail to respond with the sensitive information.
Suggested cybersecurity practices
Some phishing emails are obviously a scam and immediately deleted by recipients. Others are clever and require receivers to be alert to the subtleties.
Use the following characteristics of a phishing email to help identify those that show up in your in-box:
- A sense of urgency to respond,
- An unsolicited email appearing to come from a party you know,
- A negative consequence if you don’t respond,
- Poor grammar and spelling errors,
- Request for personal information,
- Odd payment requests,
- Suspicious links that resemble legitimate URLs with small changes, and
- Suspicious attachments.
If you receive an email with phishing attributes:
- Don’t click on any links or open any attachments. Hover over suspicious links to see the real email address or URL.
- Contact the person, business, or agency for confirmation using a known phone number or email address. Don’t reply to the fake email address or call the number provided in the email.
These same concepts apply to suspicious text messages on your phone. Many cell users rely on text alerts from their services (e.g., banks, vendors). Smishing, or SMS phishing, uses the everyday usage of text alerts to catch individuals off guard. Smishing attempts:
- Direct individuals to a website or phone number,
- Prompt users to download malware, and
- Nudge the user to act with a sense of urgency (just like the other methods of fraud).
Preventing and reporting scams
This phishing email is not the first, and probably not the last, fraudulent attempt to gain information from motor carriers.
It has happened so frequently in recent years that FMCSA has set up a Fraud Alerts webpage to warn stakeholders of impersonations.
If you have been a target of a suspicious communication, the event should be reported to U.S. Federal Trade Commission, the Federal Bureau of Investigation Internet Complaint Center, your local police, and/or state attorney general's office.
Specific to scams against motor carriers, you can reach out to the FMCSA Contact Center or call (800) 832-5660.
Key to remember: Cyber criminals continue to use the same ploys with the same objective (e.g., bank accounts, personal identifiable information). Train your employees to be suspicious and slow to open, click, and respond to any requests — whether personal or business-related communication.
