Supply Chain Security Starts With Verified Drivers, Vendors, and Partners

Verisk CargoNet estimated cargo theft losses across the United States and Canada at $304.6 million in Q2 2026 – more than double the $135.7 million estimated a year earlier – even though recorded incidents fell 26%. Several multimillion-dollar thefts helped drive the increase.

A fraudster can use a legitimate carrier’s name, registration details, or a compromised account to arrange a pickup. The driver may arrive with convincing paperwork, even though the carrier whose identity was used knows nothing about the booking. Criminals can then redirect the shipment and steal the goods.

Identity and business verification can help establish whether a supplier or carrier is genuine and who is representing it. In freight transport, supply chain security also involves confirming that the collecting driver is authorized for the specific load, helping expose impersonation and the unauthorized carrier substitutions used in fraudulent double brokering.

Identity verification in supply chains explained

Identity verification establishes whether a person is who they claim to be. In supply chains, it can expose someone using another driver’s identity, or a synthetic one, to collect a shipment, or posing as a supplier’s representative to get into an account.

Confirming a driver’s identity does not establish that the approved carrier has sent them to collect a particular load. Third-party verification can include confirming the driver’s assignment with the carrier through independently verified contact details, helping prevent goods from being released to someone impersonating its representative.

Why verified parties drive supply chain security

A shipment may pass through a manufacturer, broker, carrier, subcontractor, warehouse, and delivery team. When each participant relies on information from the previous one, an unverified identity can travel through the process.

Identity and business verification strengthen supply chain security by creating checkpoints before access or custody changes. Procurement checks the contracting company; dispatch confirms the assigned carrier and driver; warehouse staff verify the collection against the approved shipment.

This makes responsibility traceable. If the carrier, destination, or collecting driver changes, the business can identify the change and require approval before releasing goods.

Identity vs. business verification

Identity verification examines individuals, while business verification examines legal entities and the people who own, control, or represent them.

	Main question	Supply chain application
Identity verification	Is this person who they claim to be?	Checking a collecting driver or supplier representative
Business verification	Does this business legally exist, and who controls it?	Checking a carrier, manufacturer, or vendor

Driver and supplier checks use some of the same methods as Know Your Customer (KYC) and Know Your Business (KYB) processes, like identity-document checks and company ownership verification, which is why people sometimes call these processes “KYC for drivers” and “KYB for suppliers.”

💡KYC and KYB are primarily associated with customer due diligence under anti-money laundering (AML) rules. Transporting goods or purchasing supplies does not, by itself, create AML obligations, so identity verification and business verification more accurately describe these supply chain checks.

KYC for drivers and individual contractors

Someone posing as an approved driver could attempt to collect goods using a forged license or another person’s identity document. Driver verification can examine the document’s authenticity and, where available, compare its details with records held by the issuing authority. 

For digital checks completed through an app or online portal, face matching compares a selfie with the document photograph, while liveness detection helps prevent attempts to substitute a photograph or recorded video for a live person.

That verified identity can then be compared with the driver assignment confirmed by the approved carrier. Separate licensing checks establish whether the driver is currently authorized to operate the vehicle.

KYB for carriers, suppliers, and vendors

A supplier’s website and paperwork may use a trading name shared by several companies in a group. KYB verification identifies the legal entity behind the proposed contract and checks its registration, status, and ownership against corporate records and supporting documents. This helps establish which company would enter into the agreement and be responsible for fulfilling the work.

Where ownership passes through holding companies, beneficial ownership verification follows those connections to the individuals who ultimately own or control the supplier. This can reveal relationships that company names alone would obscure, such as whether two bidders presented as independent are controlled by the same person.

How to verify suppliers and vendors

Supplier verification involves checking both who a supplier or vendor is and whether it can fulfill the proposed contract. Business verification addresses the first question through checks on the legal entity and its ownership. Certifications, references, and evidence of production or service capacity inform the separate assessment of its ability to perform the work.

Registration, ownership, and control checks

Registration checks match the company named in the proposed contract with its official registry entry. Its legal name, registration number, and jurisdiction distinguish it from similarly named businesses or other companies in the same group, while its recorded status shows whether it remains active.

Beneficial ownership verification then examines who ultimately owns or controls that entity. Registry information can be compared with shareholder records and other corporate documents to substantiate the supplier’s declared ownership. Where documents name different owners, their dates may reveal an ownership change that has not yet appeared in every record.

The person negotiating or signing the contract may be an employee or agent rather than an owner. Their authority to represent the company also needs confirmation. Company records or an authorization document, such as a power of attorney where applicable, can show they have permission to enter into the proposed agreement.

Running vendor due diligence before day one

Before the first order is placed, vendor due diligence tests the evidence behind a supplier’s or vendor’s claims about its qualifications, capacity, and previous work. For a manufacturer, this might include quality certifications, deliveries of comparable goods, and production capacity for the required volume and deadline.

Independent confirmation helps substantiate those claims. Customer references can provide evidence of previous performance. When the contract requires certification or insurance, confirmation from the issuer can prove the document is genuine and covers the proposed work. Contact details obtained independently of the supplier reduce the risk of a fraudster directing the inquiry to an accomplice.

The assessment also examines how the supplier will fulfill the new order. A supplier may have completed smaller orders successfully but lack the funds to buy materials for a larger contract. If it outsources a critical production stage, delivery also depends on that subcontractor’s capacity and availability.

Alongside these operational checks, sanctions screening examines whether the supplier is subject to restrictions relevant to the proposed transaction. Registration numbers, addresses, and other identifiers help establish whether a potential match concerns the actual supplier or an unrelated company with a similar name.

Supplier due diligence checklist

For supplier and vendor due diligence:

• Confirm the contracting entity’s legal identity and current status.
• Establish ownership and control, and identify authorized representatives.
• Check necessary licenses, permits, insurance, and certifications.
• Assess sanctions exposure.
• Independently validate operating contacts and payment instructions.
• Review capacity, references, financial resilience, and subcontracting arrangements.
• Assess cybersecurity and data access where the supplier connects to internal systems.
• Record the decision, evidence, restrictions, review date, and responsible owner.

Smooth supplier onboarding

When a new supplier is onboarded, procurement, finance, and verification teams may each request the same company information. A shared application can reuse details retrieved from registries or already supplied by the representative. Once confirmed, those details remain available to each reviewing team, reducing repeated forms and document requests.

Scaling vendor onboarding across regions

Cross-border vendor onboarding draws on registries with different disclosure rules and levels of detail. One may provide shareholder information, while another confirms registration and directors only. Where the registry cannot substantiate ownership, shareholder records or other corporate documents can provide additional evidence.

Documents in different languages may also identify the company differently. During supplier onboarding, retaining local-language legal names and trading names alongside the registration number and jurisdiction helps match those documents to the correct entity. A shared record of evidence and verification results lets regional teams see what has already been established and where further review is needed.

Suggested read: KYB (Know Your Business) Verification Guide 2026

Continuous vendor and supplier risk management

Vendor risk management continues after approval. A supplier may change owners or begin outsourcing production after onboarding, altering who controls the business or fulfills its orders. Ongoing monitoring and risk assessment show how those changes affect the relationship and whether existing approvals still apply.

Ongoing monitoring of suppliers and carriers

Scheduled reviews can track document expiry dates and changes in corporate records, keeping supplier risk management current between onboarding and renewal. If a carrier’s insurance is approaching expiry, for example, you can request evidence of renewed cover before assigning another job that requires it.

Other checks respond to changes as they happen. A request to amend a vendor’s bank details can trigger an immediate vendor risk management review. Finance can confirm the instructions through a previously established contact, with payment to the new account pending until confirmation is complete.

The review record can show what changed, what evidence confirmed it, and which activities were approved afterward, so the same change is not investigated twice.

How risk scores support supply chain risk management

A supplier risk management score can combine indications of potential problems with their likely consequences. A sole supplier showing signs of financial difficulty may receive a higher risk rating because its failure could halt the buyer’s production. That exposure can justify more frequent financial reviews and planning for alternative suppliers.

Partner ratings inform supply chain risk management alongside checks on individual shipments. However, a score alone does not identify which issue needs resolving, and the reasons behind the rating determine the appropriate response. Financial uncertainty calls for evidence about the supplier’s resources, while unclear subcontracting arrangements call for confirmation of who will perform the work. 

Suggested read: Precise, Confident, and Wrong: The Trouble With KYB Risk Scores

Supply chain fraud risks you can’t see

Fraudsters can use genuine company details and compromised or look-alike accounts to disguise unauthorized bookings or payment requests. The deception may remain hidden until the real carrier disputes a collection or a supplier reports that its invoice was never paid.

Carrier and broker impersonation

An impersonator can copy a carrier’s or broker’s company name, registration details, operating credentials, or insurance documents, then supply a phone number or email address they control.

Carrier vettingincludes establishing whether that company knows about the booking. In the US, the Federal Motor Carrier Safety Administration (FMCSA) recommends confirming carrier and broker phone numbers through its Safety and Fitness Electronic Records (SAFER) system. Calling the listed number when it differs from the one provided can help confirm whether the business authorized the booking. A mismatch can reveal an unauthorized collection before goods are released, helping prevent cargo theft.

How double brokering schemes work

In fraudulent double brokering, a party accepts a load and passes it to another carrier without the necessary authority or disclosure. It can conceal which carrier is actually transporting a shipment.

A typical scheme can unfold as follows:

1. A fraudster obtains a shipment while posing as a legitimate carrier.
2. The fraudster hires another carrier to move it, concealing the real arrangement.
3. The performing carrier receives altered instructions or misleading paperwork.
4. The fraudster collects payment from the shipper or broker and leaves the performing carrier unpaid – or diverts the goods.

The second carrier may itself be a victim. The FBI’s April 2026 cargo theft warning describes criminals using compromised carrier identities, manipulated bills of lading, and drivers who are partly or fully complicit.

Business email compromise and freight diversion

According to CargoNet’s Q2 2026 analysis, compromised business email accounts provided the initial access for many of the quarter’s most sophisticated cargo theft schemes. These accounts can expose shipment information and existing conversations, allowing a fraudulent destination change to appear to come from the contact who arranged the delivery.

This access can facilitate double brokering, but diversion does not always require another carrier. The original carrier may transport the goods to a fraudulent destination while believing it is following an authorized change.

A call to the original booking contact using previously verified details can help establish whether the change was authorized. Replying within the same email conversation, or calling a newly supplied number, may simply return the inquiry to the fraudster. Independent, multi-channel confirmation of shipment requests and pickups is advised.

Fake suppliers and shell vendors

Vendor fraud can involve inventing or impersonating a supplier, misrepresenting goods or services, submitting false or inflated invoices, or colluding with an employee to manipulate purchasing decisions.

A fraudster submitting false invoices may use a shell company to provide a registered vendor name and receive payments. Shell companies can serve legitimate purposes, but an employee could misuse one by adding a company they control to the supplier list and arranging payment for work never performed. 

In a 2019 case involving US shipbuilder Vigor Marine, a former project manager was sentenced to 51 months in prison after using a fictitious vendor to charge for equipment and work never supplied. The charges passed through a legitimate vendor that did not know the company was fictitious, causing Vigor to pay out approximately $1.5 million.

Supplier verification can help establish ownership and uncover an undisclosed connection between a vendor and an employee. Matching invoices with approved orders and independent confirmation of deliveries or completed work helps test whether the charges are genuine. Separating supplier approval, receipt confirmation, and payment authorization makes it harder for an employee to approve both their own company and its false invoices.

Driver verification at every handoff

A shipment may change drivers during a subcontracted collection or a transfer between warehouses. Driver verification at each handoff helps establish who took custody and whether the transfer matched the approved transport arrangements.

Real-time ID checks at pickup and delivery

In CargoNet’s Q2 2026 analysis, incidents classified as theft fell 22.5% year on year across the United States and Canada, while fictitious pickups declined by only 4.2%. This indicates the need for stronger driver verification at pickup that combines confirming the individual’s identity with checking that the approved carrier authorized them to collect that specific shipment.

If a replacement driver arrives, an established carrier contact can verify that the substitution is authorized.

A fresh identity check using document validation and face matching can help confirm that the person present is the named replacement. A pickup code may identify the booking, but someone else can forward it to a different driver.

An unresolved identity or assignment mismatch can pause release while it is investigated, reducing the opportunity for cargo theft. At delivery, matching the location and authorized recipient with the shipment record can expose a diversion before goods change hands again.

Screening licenses and driver credentials

A genuine, unexpired license may still belong to someone whose driving privileges have been suspended. Licensing checks concern current eligibility and whether the permitted vehicle classes, endorsements, and restrictions fit the assignment. Where lawfully accessible, licensing-authority records can provide evidence beyond what appears on the document.

Responsibility for these checks depends on the role and jurisdiction. In the US, the FMCSA requires covered motor carriers to obtain and review their employed drivers’ motor vehicle records at least every 12 months.

Why one-time driver checks fall short

A driver may leave a carrier after onboarding, or another person may gain access to their delivery account. The original approval does not establish their continuing relationship with the carrier or who is using the account for a new collection.

Repeat checks can reuse an established verification record while confirming the current shipment assignment. Fresh identity checks can address a substitution or suspected account misuse.

Embedded payments and future licensing needs

A logistics platform may expand from arranging deliveries to offering driver wallets or collecting customer money before distributing it to carriers. Those services can give identity checks a regulatory purpose alongside their role in preventing unauthorized collections.

For example, the UK Financial Conduct Authority warns that marketplaces receiving customer money before passing it to sellers may be providing regulated payment services. Whether authorization or registration is required depends on the activities performed and any applicable exclusions.

Once a platform provides a regulated payment service, its customer checks become formal AML due diligence, with minimum legal requirements. Partnering with a licensed payment provider doesn’t settle who carries those duties. If the provider holds and moves the funds, it usually performs the due diligence. If the platform acts as the provider’s agent, or still receives customer money itself, some or all of the obligations may fall on the platform.

Supply chain due diligence rules that changed in 2026

Legal requirements can change the evidence needed for third-party due diligence. Mandatory supply chain due diligence may require investigation of a supplier’s labor conditions or environmental impacts, while transport-registration rules can require identity checks on the people managing company accounts. These duties concern different activities and businesses, so their scope determines which checks are required.

CSDDD after Omnibus I: What changed

The EU Corporate Sustainability Due Diligence Directive (CSDDD) sets out duties for covered companies to identify and address human rights and environmental harms in their operations and supply chains. It covers how suppliers operate and the conditions under which goods are produced.

The Omnibus I sustainability amendments approved in February 2026 reduced the number of companies directly covered. Under the main company-size test, EU companies must have more than 5,000 employees on average and net worldwide turnover above €1.5 billion. For non-EU companies, the main threshold is net turnover above €1.5 billion generated in the EU. Group-level tests and separate rules for certain franchising and licensing arrangements can also bring companies into scope.

The amendments also postponed implementation. Member states must introduce the CSDDD rules into national law by July 26, 2028, with the main due diligence duties applying from July 26, 2029.

For covered companies, detailed assessments can focus on areas where harms are most likely and severe. Those areas may lie beyond direct suppliers, deeper in the chain where production actually takes place.

Within supply chain due diligence, verified company and ownership information can help identify the supplier connected to a facility under investigation. 

FMCSA Motus and carrier identity proofing

On May 19, 2026, the US FMCSA opened Motus to new and existing registrants. This expanded access beyond the supporting companies that had used the new transport-registration system since December 2025.

FMCSA had already introduced identity checks for new registration applicants in April 2025. The Motus expansion extended identity verification to existing registrants when they first access the system. It also introduced business verification covering company details such as legal name, business address, ownership structure, and company officials.

The expanded checks target false registrations, stolen business identities, and company-account takeovers. These risks are significant for carrier vetting because criminals can use a genuine carrier’s identity to arrange shipments without its knowledge. Motus is intended to make those records harder to obtain or manipulate.

Choosing supplier verification software

KYB verification software varies in coverage, document checks, and review options. These capabilities determine how much of a supply chain’s third-party verification process it can support.

Automated vs. manual verification

Automation works well for repeatable tasks such as retrieving registry information, comparing company details, screening records, and tracking expiry dates. Manual review is useful when ownership is complex, sources disagree, or operational claims need independent confirmation.

Consider which countries, entity types, documents, and data fields providers support; check whether results are current, whether records show the underlying source, and how providers handle inconclusive cases.

Automating verification across the supply chain

During vendor onboarding, verification results can update the supplier record used by procurement and finance. An unresolved ownership discrepancy can create a review task and leave supplier approval pending. Once the discrepancy is resolved, the decision and supporting evidence can become available to all teams.

Sumsub’s Business Verification supports corporate registry checks, company-document review, ownership and management checks, and screening. Its configurable verification flows allow businesses to select the information collected and arrange the checks and review stages around their requirements.

Sumsub can check individual drivers through User Verification, alongside the company checks performed through Business Verification. A logistics business can connect an individual’s verification result with the carrier’s confirmed driver assignment in its dispatch system. At pickup, staff can compare the collecting driver with that record and refer an identity or assignment mismatch for review before releasing the goods.

FAQ: Supply chain security