Four Accounts, One Fraud Ring: What Card Fraud Looks Like on a Freight Platform

The evidence points to one coordinated operation rather than four unrelated customers. Two of the accounts ordered with the same phone number and the same email address. One account placed shipments under four different names over its lifetime. The hardest single piece of evidence is a card: the same card number appeared as actively in use on two accounts at the same time. A card sitting on two accounts at once is very hard to explain away — and it is the kind of link that name-based screening will never find.

What made the group stand out was not the accounts but the parcels. Almost every shipment measured 8 inches wide by 4 inches tall, with only the length varying — from 2 inches up to 12. One account ran the same 12 x 8 x 4 in, 22 lb declaration again and again. An earlier account used exactly that template weeks before the accounts we flagged, which suggests the operation predates the profiles we found. That shape signature is also what made the group visible: a density screen (at least 40 lb per cubic foot, combined with furniture-type commodities) returned just over 70 parcels, and only two of them had no connection to this group.

Card handling is the second signature. One account bound seven cards in five days; another bound six in seven. The sequence repeats: bind a new card, run a few shipments, unbind one to two days later, then move to the next one. By the time a carrier issued a re-weigh adjustment, the card that paid for the shipment was already gone — which is exactly how those adjustments became uncollectible. Almost every card carried an expiry of 12/33 or 12/34, the pattern you would expect from virtual or gift-card products. The funding field on those cards is null, including cards bound as recently as 21 September, so the source of the funds cannot yet be confirmed.

The losses visible today are a fraction of the real exposure. On one account, a single shipment where the carrier billed $2,464.81 produced $42.64 in revenue — a 57x gap. Three shipments on that account total roughly $2,757 before tax, and four shipments on another add about $588. Most carrier invoices for these shipments have not been imported yet, which is why the numbers on screen understate the damage. A few shipments even show a negative cost today only because re-weigh charges land on a later invoice.

What we are doing, and what other operators and shippers can take from it: block the accounts, but block the cards too — brand, last four digits and expiry rather than names, because names are disposable. Treat card churn as a first-class risk signal instead of a support ticket: three or more cards bound within a week, or a card unbound within days of being used, is worth stopping. Confirm whether an unbind in your own system actually removes the payment method at the processor, because a soft delete leaves the card chargeable. And when the dimension data is the fraud itself, chase the parcels that are still in transit and ask the carrier to re-weigh and re-bill — that is far cheaper than writing the shipments off. We have already filed a formal report with the Canadian Anti-Fraud Centre, and we are working with the card processor. For shippers the practical takeaway is narrower but real: carrier re-weigh adjustments always arrive on a later invoice, so any shipment showing an unusually low carrier cost should be treated as pending exposure rather than margin.