The Rate Con Phish: How to Train Your Team to Spot Fake Domains
The "Rate Con Phish" is the latest threat targeting the freight industry's speed. By using lookalike domains—email addresses that mimic legitimate carriers with subtle typos—scammers are tricking busy brokers into compromising their TMS credentials and falling for double-brokering fraud. To defend your brokerage, you must move beyond software filters and build a "human firewall" trained to scrutinize every sender domain before clicking.
Jan 21, 2026
Zach En'Wezoh
In the high-speed world of freight brokerage, the pressure to move loads quickly renders your team vulnerable to one of the most insidious modern threats: "The Rate Con Phish." Attackers know that a subject line promising a signed rate confirmation demands immediate attention, and they weaponize this urgency.
The crux of this attack isn't just a malicious attachment; it’s the use of lookalike domains. These email addresses mimic legitimate carriers or shippers with barely noticeable changes. An attacker might register carrier@logistics-corp.com to impersonate the real carrier@logisticscorp.com, banking on the fact that a busy broker won't notice the added hyphen. A rushed click on a link disguised as a PDF attachment can compromise your TMS credentials, expose sensitive data, and open the door to significant financial fraud like double-brokering.
Defending against these highly targeted attacks demands more than just standard spam filters. It requires building a human firewall through consistent training. You must condition your carrier sales and operations teams to look past the display name and immediately inspect the actual sender domain for subtle misspellings, swapped letters (like an 'l' for an 'i'), or added characters. The golden rule for your team should be simple: if a "rate con" arrives unexpectedly, or if the domain doesn't match the carrier’s known profile exactly, they must pause and verify via a separate phone call. By building this reflex to scrutinize every incoming domain, you turn your team from potential victims into a vital layer of defense against fraud.
