When we think about the theft of a Lamborghini or a Rolls-Roycethe usual thing is to imagine a physical scene: a forced lock, a broken-in garage or, in the most cinematic version, an interception in the middle of the road. That image is still very present because for years it was the most visible form of this type of crime. However, in the last two years a different and much less obvious fraud has spread. Some of these cars do not disappear on the street, but at a previous and almost invisible point: the digital process that organizes their transportation from one city to another.
Imagine this scene: someone buys a luxury vehicle in one city and organizes its transfer to another through a common service in the sector. The car is loaded onto a closed trailer in front of the owner, the documentation appears correct and the delivery schedule fits what is expected in an operation of this type. Everything responds to a logistical routine that, in theory, should be resolved in a few days without any problems. However, in some cases this outcome never occurs and the vehicle ceases to exist within the planned route.
When theft sneaks into logistics
To understand where the problem really begins, we have to look at a piece that is little visible outside the sector: the so-called “load boards”. These are digital markets where dealers, manufacturers or owners publish the transfer of a vehicle between two pointsindicating origin, destination, dates and Price, so that carriers or intermediaries accept the order. This system has gained weight because it streamlines operations that previously depended on phone calls and personal relationships. For example, the Central Dispatch platform is one of the best known in the sector in the United States.
The gateway to that system does not require forcing anything physical, but rather taking advantage of known weaknesses in the digital environment. One of the most used methods consists of phishing emails that appear to come from the transport platforms themselves. When a broker or carrier enters their credentials on a fake page, the attacker gains real access to their account and can operate as if they were the legitimate company. From there, you can modify contact information and start accepting high-value vehicle orders by taking advantage of that compromised digital identity.
Phishing is not the only way in. The complaints also point to another less technical and more structural crack: the possibility of appear legitimate within the US regulatory system itself. To operate in these digital markets it is necessary to have a number from the United States Department of Transportation, known as USDOT, which identifies commercial transportation companies. However, it is not particularly complex to create shell companies and obtain that identification, which allows you to present yourself to the platforms as an apparently authorized operator.
With that access and that appearance of legitimacy, fraud takes its decisive step within the logistics chain itself. This, precisely, is where “double-brokering” comes into play, which consists of claiming a transport order and republishing it from another account so that it can be accepted by a driver completely unaware of the deception. This professional picks up the vehicle believing that he is performing an ordinary service and follows the delivery instructions he receives during the process, without indications that he is part of a fraudulent maneuver. The result is that the car ends up at a destination other than the one intended without, at that moment, there being an obvious sign of theft for whoever sent it.
The most disconcerting thing about this scheme is that it does not require violence, not even visible action on the vehicle. Everything happens within a process that, from the outside, continues to appear legitimate: the car is collected correctly, the transfer continues and communications flow through channels that appear normal. By the time the owner detects that something doesn’t fit, the vehicle has already been delivered at a point other than planned and has left the circuit that allowed its route to be traced. This lack of immediate signals is precisely what makes fraud so difficult to anticipate.
The last link in the scheme is rapid monetization. Diverted vehicles may end up resold in the United States with new papers or loaded into containers for shipment to overseas buyers. In some cases, when the owner discovers that the car has not arrived at its destination, it has already been sold or has even left the country. The impact is enough to show an underlying tension: the sector’s jump to these online markets has advanced faster than the mechanisms capable of protecting them against this type of fraud.
Images | Dhiva Krishna | Dhruv Sharma
In WorldOfSoftware | Entering Discord showing your ID is just the beginning: there is a great battle on the internet against anonymity
