Manav.id
Vertical · 4 min read

The rate confirmation that changed bank accounts: freight payment diversion

The rate confirmation that changed bank accounts: freight payment diversion

In most industries a vendor changing bank details is unusual enough to be a red flag. In freight it happens constantly, for entirely legitimate reasons, and that is exactly what makes the fraud work.

Why is a notice of assignment such an effective forgery?

Because legitimate ones arrive constantly. Carriers change remit-to details often, since factoring relationships start and end. That churn is the camouflage: a forged notice of assignment looks exactly like the twelve genuine ones a broker processed last month.

Key takeaways
  • Notices of assignment arrive as PDFs on letterhead. Verification is a call to a number that may have come from the same packet.
  • Three parties hold a stake in the same fact — carrier, factor and broker — and none of them can verify it independently.
  • A tri-party assignment receipt eliminates the callback loop rather than trying to make the callback more reliable.

A Tuesday in accounts payable

Carrier factoring changes oftenlegitimate churnNotice of assignment arrivesletterhead, standard formBroker updates remit-toroutine changeSettlements redirectedfound at reconciliation
Frequency is the attacker's cover. Nothing about the document is unusual.

The email arrived at 10:41 on letterhead she recognised. A notice of assignment: this carrier had entered a factoring agreement, and all future payments should go to the factor's account. Attached was the assignment document, signed. A phone number was printed at the bottom.

She called it. A professional voice confirmed the details, referenced the carrier by name, and offered to resend the document. She updated the remit-to record and released forty-one thousand dollars in settlements over the following three weeks.

The real factor called on a Thursday about non-payment. By then the account was closed.

Nothing in that sequence involved a mistake by the AP specialist. She followed the procedure exactly. The procedure was the vulnerability.

Why freight is structurally exposed

Four conditions combine, and freight has all four.

The callback loop, drawn

The verification procedure most brokerages follow has a circularity that is obvious once drawn and invisible in a policy document.

forged packet ───────────┐
   │ assignment document  │
   │ letterhead           │──► AP verifies by calling
   │ contact number ◄──────┼─── the number in the packet
   └─────────────────────┘

Calling a number sourced from the document under verification is not independent confirmation. Using a number from your own carrier record is better and still fails when the carrier's own email was compromised, which is the more sophisticated version of this fraud.

The tri-party receipt

Three parties care about the same fact. Give all three an independently verifiable record of it.

  1. The carrier's authorised principal signs a canonical statement: this carrier, this factor, this account, effective this date, superseding prior instructions.
  2. The factor countersigns, confirming the relationship from their side.
  3. The broker verifies both signatures offline against published keys and updates the remit-to record.
  4. All three retain the receipt. Any subsequent dispute resolves against it.

No callback occurs, because there is nothing to call about. The document is not evidence of the arrangement; the signatures are.

Rendering the account detail in full

One implementation detail that matters more than it looks. The statement must render the full account number and routing details as the signer saw them — not masked, not truncated.

Masking is a security reflex borrowed from consumer interfaces and it is actively harmful here, because it hides exactly the characters an attacker alters. A carrier principal confirming ****4821 has confirmed nothing about the first twelve digits.

What to measure first

  1. Count banking changes processed in the last twelve months.
  2. Count how many were verified by any means beyond reading the document.
  3. Count how many were verified using a contact detail sourced from the document itself.
  4. Compute your average settlement exposure per carrier over a three-week window — that is your loss per undetected diversion.

The third number is usually the one that ends the debate internally.

Limits

Freight-specific diversion losses are not published separately from general business email compromise figures, so this article does not assert a sector loss total. The mechanics are well documented; the aggregate is not.

The receipt also does not resolve genuine commercial disputes about assignment priority under UCC Article 9. It establishes what was instructed and by whom, which is a factual prerequisite to that legal question rather than an answer to it.

What distinguishes a real notice from a forged one

Available signals, ranked
SignalStrength
Letterhead and formNone — both are standard
Factor is a known companyWeak — real factors are impersonated
Carrier confirms by phoneModerate — if the number predates the notice
Release letter from the prior factorModerate — also forgeable
Signature from the carrier's enrolled credentialStrong

Objections and honest limits

“We verify with the carrier every time.” If the number comes from your carrier record rather than the notice, that is a real control. It is also minutes per notice, which is why it degrades under volume.

“Factors should police this.” Factors are impersonated as often as carriers. The party who can settle it is the carrier, and the carrier is not currently asked to do anything.

Gating the remit-to change

  1. Treat a notice of assignment as a payment instruction change. Not correspondence.
  2. Require the carrier's signature, not the factor's letterhead. The carrier is the party whose money it is.
  3. Render the delta. Previous remit-to, new remit-to, and when it last changed.
  4. Hold the first settlement after a change. A short delay, and the only realistic recovery window.

Terms used here

Notice of assignment
A document instructing that payment be made to a factor rather than to the carrier.
Factoring
Selling receivables at a discount for immediate cash — common in trucking, and the reason remit-to details change often.
Remit-to
The party and account freight payments are made to.

Frequently asked questions

Is this not solved by paying only to verified factors? Factor verification confirms the factor exists. It does not confirm that this carrier assigned its receivables to that factor, which is the fact being forged.

What about carriers with no factoring relationship? The same structure applies to a direct remit-to change: the carrier's authorised principal signs, and the broker verifies. The factor countersignature is simply absent.

Does this slow settlement? It removes a callback that typically takes a day or more to complete. In practice it accelerates the change rather than delaying it.

Who is the carrier's authorised principal? Whoever the carrier designates, recorded once at onboarding as a signed delegation. That designation is itself something most brokerages have never captured formally.

Why is this forgery effective? Because genuine notices arrive constantly. Legitimate churn is what conceals the fraudulent one.

Who should sign it? The carrier. It is their receivable, and they are the only party who can settle the question definitively.

What is the cheapest containment? A short hold on the first settlement after a remit-to change.

Where this fits in Manav

Manav binds the authorising party to the exact instruction, endorsement or adjustment, and produces a receipt a counterparty can verify without a phone call.

See instruction receipts →

Sources and further reading