Fictitious pickup: designing a dock release gate that assumes every document is forged
The shipping clerk's job is to match documents to expectations. That is a reasonable job description and it is also, precisely, the attack surface — because a prepared thief optimises for exactly the comparison the clerk is trained to perform.
How do you design a dock release gate that assumes every document is forged?
By requiring something the driver cannot carry. A rate confirmation, a bill of lading number and a licence are all documents, and document matching is precisely what a fictitious pickup prepares for. The gate has to check a signature tied to the tender, not paper tied to a person.
- Every element the dock checks — rate confirmation, BOL number, licence, truck number — is reproducible. The callback number is frequently supplied by the same forged packet.
- The fix is to stop checking documents: the broker signs a load-bound delegation to a specific driver credential, and the dock verifies a signature offline.
- Per-incident values in 2026 industry data run into the hundreds of thousands of dollars, so a gate that fails a handful of legitimate pickups still pays for itself.
Part of Freight, cargo and customs identity
Prerequisites
- Your last twelve months of pickups by lane, with commodity value.
- Your current dock release procedure, written down as it is actually performed rather than as the SOP describes.
- The contact path your clerks use when something looks wrong, and who answers it.
Step 1 — Write down what you actually check
Ask three clerks to describe the release procedure independently. The list will converge on something like this:
- Driver presents a rate confirmation or pickup number.
- Clerk matches it against the appointment in the warehouse system.
- Clerk checks the driver's licence name against the carrier on the paperwork.
- Clerk records the truck and trailer numbers.
- For high-value loads, clerk calls the broker on the number in the paperwork.
Now annotate each step with what a prepared impersonator supplies: a forged rate confirmation with a real pickup number obtained from a load board, a real licence belonging to the real person driving, a real truck, and a phone number that rings a confederate.
Step five is the one worth pausing on. Calling a number printed on the document you are trying to verify is not verification. It is a loop.
Step 2 — Size the exposure by lane
Not every dock needs this. Rank lanes by commodity value per truckload and by the share of pickups performed by carriers you have not used before.
| Lane characteristic | Priority |
|---|---|
| High value per load, frequent new carriers | First |
| High value per load, established carriers only | Second |
| Low value, frequent new carriers | Third |
| Low value, established carriers | Not worth instrumenting |
Step 3 — Replace the check with a verification
The design inverts the current flow. Instead of the driver proving identity through documents that the dock evaluates, the broker issues an authorisation that only the assigned driver can exercise.
- When the load is tendered, the broker signs a delegation naming the carrier, the load, and the specific driver credential, with an expiry covering the pickup window.
- The driver receives it as a link or QR on their own device. Nothing is emailed as a PDF.
- At the gate, the driver presents a signed assertion under that delegation.
- The dock verifies the signature against a published key. Offline. No call, no lookup, no connectivity requirement.
- Release proceeds, and the verification produces a receipt attached to the shipment record.
A thief holding a perfect copy of every document has nothing to present at step three, because the assertion requires the private key on the assigned driver's device.
Step 4 — Plan the exception path before go-live
This is the step that determines whether the control survives contact with operations. Legitimate pickups will fail verification: a driver swap at the last minute, a dead phone, a carrier that has not enrolled.
Define the fallback explicitly and make it deliberately slower than the happy path: supervisor approval, callback to a number held in your own carrier record rather than the paperwork, and a recorded exception. If the fallback is as fast as the gate, everyone will use the fallback.
Step 5 — Measure the right things
- Verification success rate at the gate, weekly. A falling rate means enrolment is breaking, not that fraud is rising.
- Exception rate and reason codes. Concentrations tell you which carrier needs help enrolling.
- Gate dwell time before and after. If it rises by more than a few seconds, the implementation is wrong.
- Attempted pickups that failed verification and did not return. This is the number that justifies the programme, and it is the hardest to attribute honestly.
Failure traps
- Do not email the delegation. A delegation that arrives as an attachment is a document again, and you have rebuilt the problem.
- Do not bind only to the carrier. Binding to the carrier and not the driver leaves the impersonation surface intact at the gate.
- Do not make verification depend on the dock having connectivity. Many do not, reliably, and a control that fails on a bad LTE signal will be bypassed within a week.
- Do not start at your largest lane. Start where a failure is survivable.
What a gate can actually test
| Check | Strength |
|---|---|
| Paperwork matches the tender | Weak — the thief has the paperwork |
| Driver licence matches the name given | Weak — the name was chosen to match |
| Phone the broker on the rate confirmation | Weak — number is on the document |
| Phone the carrier on a number from the carrier record | Moderate, and slow at a busy dock |
| Verify a signature bound to this tender | Strong, and seconds |
Objections and honest limits
“We vet carriers carefully.” Vetting the carrier is right and it is not what fails. The failure is that the person at the dock is not demonstrably from the carrier you vetted.
“A dock cannot add minutes per pickup.” It cannot. A signature check is seconds and can be done while the driver is still in the cab, which is faster than the callback it replaces.
Designing the gate
- Bind the release to the tender, not to paperwork. The tender is the thing only the real parties know.
- Require a signature from the assigned driver or dispatcher. Issued when the load was tendered, not at the dock.
- Make it fail closed. No valid signature, no release, regardless of the paperwork.
- Log the release with the receipt. So a loss investigation is a retrieval.
Terms used here
- Fictitious pickup
- Collecting freight by impersonating the assigned carrier, using genuine-looking documentation.
- Rate confirmation
- The document confirming the agreed rate and load details, routinely used as proof of entitlement at the dock.
- Tender
- The offer of a load to a specific carrier, and the fact a thief has to reproduce rather than forge.
Frequently asked questions
What if the carrier sends a different driver? The broker re-issues the delegation to the new driver's credential, which takes seconds. Last-minute driver changes are normal and the design should treat them as routine rather than as exceptions.
Do drivers need a company device? No. The credential lives on the driver's own phone, enrolled once. That is deliberate — requiring company hardware would make carrier adoption impossible.
Does this work for drop-and-hook? Yes, and it is arguably more important there, because unattended equipment removes even the document check.
What does this cost the shipper? A verification step at the gate measured in seconds, plus the work of getting carriers enrolled. The enrolment effort is the real cost and it is front-loaded.
Why doesn't document matching work? Because the documents are what the thief prepared. Matching them confirms the preparation, not the identity.
Isn't carrier vetting the answer? Vetting is right and is not what fails. What fails is confirming the person at the dock is from the carrier you vetted.
Can a busy dock afford this? A signature check takes seconds and replaces a callback that takes minutes.
Where this fits in Manav
Manav binds the authorising person to the exact release, tender or instruction, and produces a receipt a shipper, a terminal or a broker can verify at the gate without a phone call.