How to vet a carrier in four checks

Every brokerage has a carrier vetting policy. Almost none of them survive six o'clock on a Friday when the container has to move, the regular carrier has no truck, and a stranger has just quoted a rate that works.

The four checks below take a few minutes each. The difficulty was never the checking. It is that a policy which can be skipped under pressure is a suggestion, and the moment you need it most is exactly the moment it gets skipped.

What you are actually defending against

Double brokering is a carrier accepting your load and quietly re-brokering it to someone else. You tendered to a company you vetted; the freight is on a truck belonging to a company you have never heard of.

That is a total-cargo-loss exposure, and the reason is worth being precise about. The cargo policy you verified belongs to the carrier you booked — the one who never touched the freight. When the load disappears, the claim is against a carrier who has no policy, no assets and frequently no address. Your own contingent cargo coverage may exclude the loss precisely because the freight moved under an unauthorised subcontract. Meanwhile the truck that actually hauled it was never paid by the double broker, so the real carrier comes after your customer, and possibly after you, for money you already paid to someone else.

The modern version is worse and more common: identity theft. Somebody registers a domain one character off a legitimate carrier's, sets up a phone number, and quotes using the real carrier's MC number, real safety record and real insurance certificate. Every document they send you checks out, because all of it belongs to a company that is not them.

That is the specific attack the four checks are shaped around.

Check 1 — Authority

The FMCSA is the registry. Everything begins with looking up the MC docket number and the USDOT number and confirming that what comes back matches what the carrier told you.

What to actually look at:

• Operating authority status. Active is the only acceptable answer. Not pending, not revoked, not "authority granted, insurance not on file". A revoked authority that reactivated last week deserves a question.
• Authority type. Motor carrier of property is what you want. A company holding only broker authority while presenting itself as a carrier is telling you, on the record, that it intends to re-broker your freight.
• MC and DOT belong to the same entity. They are two numbers on one registration. A packet that pairs one company's MC with another company's DOT is not a clerical error.
• The address and phone on the registration. Compare them to the packet, the email signature and the invoice remit-to. A registration whose address or phone changed very recently is the single strongest signal of an authority hijack — that update is how the fraudster redirects your calls.
• Safety rating and out-of-service rate. Satisfactory, Conditional, Unsatisfactory, or none assigned. A rating of Conditional is not automatically disqualifying, but it is a decision someone should make deliberately rather than by not noticing.
• Fleet size against the work. A one-truck authority quoting five containers a day out of a port three states away is either brokering it or not doing it.

Check 2 — Insurance, both policies, with expiry dates

Two separate coverages, and they are required for different reasons.

BIPD — bodily injury and property damage. The federal auto liability minimum for general freight in interstate commerce is $750,000. That figure is a legal floor, not a standard; most shipper contracts require a million, and yours probably does too. Because the liability filing is made with FMCSA, the registry will tell you whether a policy is on file at all — which is a useful independent confirmation that the certificate in your inbox reflects something real.

Cargo. For most motor carriers, cargo insurance is not federally mandated — the FMCSA filing requirement applies to household goods carriers. Cargo coverage is a contractual requirement you impose, which means nobody is checking it for you.

On cargo, the exclusions matter more than the limit:

• Theft of an unattended vehicle or trailer, which is most cargo theft.
• Reefer breakdown, which needs its own clause and is usually not there by default.
• Whether intermodal containers and equipment on interchange are covered at all — the drayage-specific gap.
• Whether freight moved by a substituted or subcontracted carrier is excluded. It almost always is. That single exclusion is why double brokering is a total loss rather than a claim.

And on both policies: the expiry date is data, not trivia. A certificate proves coverage existed on the day it was issued. Policies get cancelled mid-term and nobody is obliged to make sure you hear about it. The right handling is to store the expiry as a field, watch it, and re-verify on a fixed clock — thirty days is a reasonable freshness window for a carrier you use regularly — rather than filing a PDF and considering the carrier permanently approved.

Get the certificate from the agent or the insurer where you can. A certificate forwarded by the party being vetted is a document under their control.

Check 3 — W9

This looks like the boring one. It is where the payment fraud lives.

The W9 gives you the legal name and the taxpayer identification number, which you need for 1099 reporting. Its real value is as a cross-check: the legal name on the W9, the name on the operating authority, and the name on the invoice should be the same company. When they are not, you have found something — sometimes a legitimate DBA, sometimes a re-broker, sometimes an impostor.

Related, and worth the same attention: factoring and remit-to changes. A carrier that factors its invoices has assigned payment to a third party, and a notice of assignment redirects your payment to the factor. A forged notice of assignment, or an emailed request to update banking details, is one of the most reliable ways to steal a payment from a brokerage. Any change to where money goes gets verified out of band — a phone call to the number on the FMCSA registration, never the number in the email asking for the change.

Check 4 — A human signs their name

Three documents on file is a state. It is not a decision, and software that treats a complete checklist as an approval has automated the wrong half of the job.

Somebody has to look at the whole packet at once and write down why they approved it: the equipment matches the work, the domicile makes sense for the port, the phone answers with the company name, the fleet supports the volume, the recent authority change was explained. That written comment is the entire value of the audit trail. "Approved" with no reasoning tells a future reader nothing, and a future reader is exactly who needs it when a load goes missing.

It is also worth putting the prohibition in writing where it will be read. A rate confirmation should say, in terms, what the carrier is not permitted to do:

This load may not be re-brokered, interlined or otherwise tendered to any other carrier. The carrier named above must transport the freight on its own authority, with its own equipment and its own driver.

That clause does not stop a fraudster. It does decide the argument afterwards, and it makes the rule unambiguous for the honest carrier who was about to do you a favour by handing it off.

Then hold the line on the consequence: while any of the four checks is outstanding, the dispatch paperwork does not generate. Not a warning banner. Not an override with a confirm dialog. Refusal. A gate that can be clicked past under pressure is not a gate, and pressure is the environment it was built for.

Where the paperwork goes

One more rule, and it costs nothing: carrier documents go only to the email address on the FMCSA record.

This is the countermeasure to the identity-theft case, and it works even when everything else in the packet has been faked. The fraudster controls a lookalike domain and a phone number. What they do not control is the email address registered against the real carrier's authority. Send the rate confirmation there and the impostor never receives the load details — the real carrier does, and calls you confused, which is the outcome you want.

The corollary is uncomfortable and correct: if there is no FMCSA-registered email on file, the document does not send at all. No manual address entry, no "just this once". The manual override is the whole vulnerability.

The four checks, in order

1. Authority — MC and DOT active, same entity, type correct, address and phone consistent, recent changes explained.
2. Insurance — BIPD and cargo, limits adequate, exclusions read, expiry dates stored and watched.
3. W9 — legal name and TIN matching the authority and the remit-to; any banking change verified by phone to the registered number.
4. Sign-off — a named reviewer, a written reason, and a hard block on dispatch until it exists.

Minutes of work. The reason to build it as a gate rather than a checklist is not that people are careless. It is that the load that most needs the check is always the one with the least time left.