Cyber
Coverage for breaches and some online fraud, and the different scams that hit brokers and carriers that a cyber policy may or may not touch.
Short answer
Cyber coverage is generally a policy for the costs of a data breach or a network attack, such as response and recovery costs, business interruption, extortion, and claims about leaked data. It is not a general fraud policy. Losses from a fake invoice, a changed bank account, or a stolen MC number may be covered only by a sublimit, a separate social engineering or funds-transfer fraud coverage, or a crime policy, and some are not covered at all. How a loss is described and how the fraud happened decides which part, if any, responds.
How does cyber insurance work for a freight broker or carrier?
Brokers and carriers run on email, load boards, rate confirmations, and payments to parties you have never met. That is where the fraud is. It is also where cyber policies are most commonly misunderstood. Two things get lumped together as "cyber" and they are different:
- A cyber event. Someone gets into your systems or data: ransomware locks your TMS, a breach exposes driver or customer records, or a compromised account is used to attack others. Cyber coverage is written for the costs of that.
- A fraud event. Someone tricks you or your staff into sending money or freight to the wrong party, with no break-in at all: a fake bank-account change email, a spoofed broker, a double-brokered load. Whether cyber coverage touches it depends on the policy.
The FBI's Internet Crime Complaint Center describes business email compromise as a scam targeting businesses and individuals that make transfers of funds, in which criminals compromise legitimate business email accounts through social engineering or computer intrusion.
Cyber coverage versus funds-transfer fraud coverage. Cyber policies can have two kinds of coverage, and the second is where the freight-industry scams usually land.
| Cyber coverage (breach and attack) | Funds-transfer or social engineering fraud coverage | |
|---|---|---|
| What it is for | Costs of a security incident on your systems and data | Money you voluntarily sent because someone deceived you |
| Examples | Ransomware, data breach, system outage, extortion | A fake payment-change email, an impersonated customer, a spoofed carrier |
| How it shows up | Often the core of the policy | May be a sublimit inside the cyber policy, a separate endorsement, or part of a crime policy |
| What to read | Limits for response costs, business interruption, and liability | The sublimit amount, the verification conditions, and the definition of a covered scam |
Policies differ on whether they include social engineering coverage at all. Where they do, they may attach a condition, such as a call-back to a known number, and a claim may not be paid if the condition was not followed. Read for conditions, not just the existence of the coverage.
What the freight scams usually point to. These are the common T&L fraud patterns, and the policy they most often point to. Whether a particular loss is covered turns on the wording, so this is a map of where to look, not a promise.
| The scam | What happens | Where to look first |
|---|---|---|
| Load-board fraud | A fake or hijacked posting leads you to haul, or pay, on a load that doesn't exist or isn't what it seems | Your contract and the load's paperwork; possibly social engineering or crime coverage for money lost; not cargo coverage if no real freight moved |
| Double brokering | A carrier accepts a load, then secretly hands it to another carrier, and freight goes missing or payment goes astray | Motor truck cargo or contingent cargo for freight; professional liability for a broker's mistaken service; cyber is more likely to respond only if a system was compromised |
| Identity theft of an MC or USDOT number | Someone uses your authority details to book loads or defraud brokers and shippers | Cyber for response costs if your accounts were breached; legal and regulatory steps; cargo and liability policies may not respond to claims against the real company |
| Payment and invoice scams | A fake email changes where you send payment or asks you to pay a fake invoice | Social engineering or funds-transfer fraud coverage, or crime coverage; ordinary cyber coverage may not respond |
| Phishing and account takeover | A spoofed email or look-alike site captures a login to your load board, banking, or TMS | Cyber for the incident response and recovery; social engineering coverage if money is then sent |
If someone is using your MC or USDOT number or your company's name to book loads, tell the brokers and shippers affected, your bank, and your insurer or agency, and report it to FMCSA, which registers carriers and brokers, and to law enforcement. For payment scams, the FBI IC3 takes complaints at ic3.gov.
What does cyber insurance cover, and what doesn't it?
Policies vary. Read your declarations, definitions, and exclusions. In general:
Often covered
- Incident response. Forensics, legal help, and notifying affected people after a breach
- Data restoration and system recovery after an attack, such as ransomware
- Business interruption from a covered outage, usually after a waiting period
- Extortion. Costs tied to a ransom demand, under many policies
- Privacy and network liability. Claims by people whose data was exposed, or whose systems were attacked through yours
- Social engineering or funds-transfer fraud, under some policies, typically with a lower sublimit and verification conditions
Often not covered, or covered only with conditions
- Money you sent because you were deceived, unless social engineering or funds-transfer fraud coverage is included. It is frequently a sublimit or a separate policy.
- Fraud by your own employees, usually crime coverage, not cyber. See management liability.
- Cargo and freight losses, even when a scam caused them. That is motor truck cargo or a contingent cargo form.
- Bodily injury and property damage. Those go to general liability and primary auto liability.
- Fines and penalties, depending on the policy and the law
- Failure to maintain security that you represented on the application, under some policies
- Betterments. Upgrading your systems beyond what they were before the loss
- Prior known incidents and acts before a retroactive date
- Losses from unsecured devices or missing controls, if the policy conditions coverage on certain security controls
Policies often ask whether you use multi-factor authentication and call-back verification for payment changes. Answer those questions carefully, since a misstatement can cost you a claim. These are common patterns, not universal ones.
Cyber insurance does not stop fraud. Verify requests through a second channel, check sender addresses closely, and monitor accounts for irregularities. The FBI IC3 also recommends contacting your bank immediately after a fraudulent transfer to request a recall, and filing a complaint at ic3.gov.
What affects the cost of cyber insurance?
We don't publish prices. Cost is set by insurers and the licensed agents you work with. These are the factors that generally move it:
- Revenue and size. How much money moves through you
- Records you hold. The volume of driver, customer, and payment data
- Security controls. Multi-factor authentication, backups, endpoint protection, and staff training
- Payment procedures. Call-back verification, dual approval for changes, and who can change bank details
- Systems you depend on. TMS, load boards, banking portals, and email
- Limits and sublimits. Especially the sublimit for social engineering and funds-transfer fraud
- Retention and waiting period
- Incident history
- Operation type. Brokerage, carrier, or a mixed business
Who typically needs cyber coverage?
- Brokers and dispatchers: The most exposed group. You move money to and from carriers and shippers, you handle rate confirmations by email, and you hold carrier and customer data.
- New authority: A new carrier may be targeted because its authority details are public and its processes are new. Ask what the policy says about payment-change scams.
- Small fleets: Fleets that run a TMS, ELD portal, or accounting system hold driver and customer data.
- OTR and local haul: Carriers that take loads off boards face fake loads and account takeover on those boards.
- Couriers: App and online-dispatch accounts are a target if you rely on them for payment.
- Towing and repair: Shops that keep customer records, payment data, and fleet accounts online have breach exposure.
What do agencies and insurers usually ask for?
- Your revenue and the type of business: brokerage, carrier, or mixed
- The systems you use: TMS, load boards, accounting, banking portals, email
- Security controls: multi-factor authentication, backups, endpoint protection, and staff training
- How payment changes are verified, and who can approve them
- The kinds of data you hold and how many records
- Prior incidents or claims
- Currently insured: the current declarations page and any sublimit schedule
Before you accept a policy, read the social engineering sublimit, its verification conditions, the definition of a covered incident, and any security-control warranties.
Frequently asked questions
Does cyber insurance cover a fake invoice or a bank-account change scam?
Possibly, but often only through social engineering or funds-transfer fraud coverage, which may be a sublimit or a separate policy. Ordinary cyber coverage may not respond. Ask whether it is included and what conditions apply.
Is double brokering covered by cyber?
Possibly not. Double brokering is usually a freight and contract problem, so the places to look first are motor truck cargo, a contingent cargo form, and professional liability. Cyber coverage is written for system and data incidents, so it is more likely to come into play only if a system or account was compromised along the way. Read your wording.
Someone is using my MC number to book loads. What do I do?
Contact your insurer or agency, your bank, and law enforcement, tell the brokers or shippers affected, and report it to FMCSA, which registers carriers and brokers. Check your policy for what it says about identity theft.
What should I do right after a fraudulent payment?
The FBI IC3 advises contacting your bank immediately to request a recall or reversal and a hold harmless letter, and filing a complaint at ic3.gov. Then notify your insurer as your policy requires.
Does cyber cover my cargo if a scam caused the loss?
Generally not. Freight losses go to motor truck cargo or a contingent cargo form, subject to their own exclusions. Read each for fraud or deception exclusions.
Can BreadRoute place or recommend a cyber policy?
No. BreadRoute is not a licensed insurance agency and does not recommend policies. If you start an insurance request, it goes to licensed partners, who handle any coverage options.
Sources
- Business Email Compromise, FBI Internet Crime Complaint Center (IC3), 2026
Last reviewed: