Fake FMCSA Emails: A Verification Checklist for New Carriers
A caller knowing your USDOT number does not make them the government. Use this repeatable verification process before sending documents, granting access, or paying an unexpected bill.
The short answer
- Your public carrier details can appear in a convincing scam. Knowing your name or USDOT number is not proof of identity.
- Verify a request through an independently reached official channel, not the link or phone number in the suspicious message.
- Do not share passwords, one-time login codes, or account recovery codes with a caller or vendor.
- If you already shared information, secure the affected accounts and contact the relevant agency or financial institution promptly.
New carriers face a crowded inbox at exactly the point when everything feels urgent: insurance, registration, safety files, and first-load preparation. A message that repeats your business name and threatens a missed deadline can look like the next legitimate task. Separate the claim from the sender. A real compliance obligation does not authenticate the person asking you to pay for it.
What FMCSA actually warns about
FMCSA’s Fraud Alerts page documents fake audit requests, bogus carrier-status notices, SAFER impersonation, and look-alike Motus links. Reviewed October 28, 2026, the page also explains that public registration information can prompt private vendor solicitations. FMCSA says it does not contact regulated entities through telemarketers or automated solicitations. These alerts describe observed schemes, not a complete list of every possible scam.
| What arrives | Why it deserves scrutiny | What to do instead |
|---|---|---|
| An urgent audit document request | It may impersonate a real federal or state audit contact | Confirm the request with the agency using independently obtained contact information |
| A payment demand using your MC or USDOT number | Public carrier details are easy to repeat | Identify the underlying obligation, recipient, and fee before paying |
| A link to a new registration portal | Branding and familiar words can hide a look-alike domain | Navigate from the official FMCSA website rather than the message |
| A request for a login code or account recovery code | The code can give someone control of your account | Stop the exchange and secure the account through its official sign-in page |
A five-step verification routine
Verify an unexpected compliance request
- 1
Pause the transaction
Do not pay, open attachments, upload identity documents, or grant remote access while the sender remains unverified. Save the message so you can investigate without continuing the conversation.
- 2
Inspect the actual destination
Read the full hostname, not just the display name or logo. A government acronym inside a private domain does not turn that domain into a government system. A padlock only indicates an encrypted connection, not government ownership.
- 3
Start a separate official session
Open your own bookmark or navigate independently to the FMCSA website. Use the agency’s current registration links and contact information; do not use the suspicious message as your directory.
- 4
Verify the specific obligation
Ask what filing, record, or appointment is actually required and where that requirement can be confirmed. A legitimate vendor should distinguish its optional service charge from government requirements and third-party fees.
- 5
Record the decision
Note the verified contact, date, obligation, and next action in your launch checklist. This keeps another person on your team from paying the same questionable request later.
A real new entrant safety audit still requires attention. The safe response is to authenticate the request, not ignore all audit communications. Use the new entrant safety audit guide to prepare your records while confirming who is authorized to receive them.
If you already clicked, paid, or shared documents
- If credentials or codes were shared, change affected passwords through the official service, review recovery settings and account access, and contact that service’s support team.
- If money was sent or payment information exposed, contact your bank or card issuer promptly. Ask about protective steps and dispute options; recovery is not guaranteed.
- Preserve original messages, email headers, transaction references, and screenshots. Do not forward sensitive identity documents broadly as part of the investigation.
- Contact FMCSA through its official website if registration records or agency impersonation are involved. Its fraud page also identifies FTC and FBI reporting options.
- If identity documents were exposed, follow the relevant identity-theft reporting and recovery process. A password reset alone does not address document misuse.
Make the rule easy for your team to follow
Keep one list of approved vendors and official bookmarks. Require a second check before changing payment instructions or sending identity documents to a new recipient. Keep account ownership and recovery methods under the carrier’s control. The Motus identity verification guide explains why the owner’s personal verification should not become a shared vendor login.