Carrier Verification and Driver Data: Where Your Information Goes

This is an opinion piece. Where it states facts about a named company, it points to that company's own published policy so you can read it yourself. Where it gives my view, it says so.

One load, one hour

It took us almost an hour to get verified for one load.

Not a contract. Not a lane. One spot-market load that wasn't paying well. Before we could take it, the driver had to upload his driver's license, take live photos of his own face, and consent to that biometric data being stored by a company he'd never heard of, for up to three years according to the consent screen.

He told me it made him uncomfortable. He did it anyway, because the load was on the other side of the screen.

Then the load canceled.

That hour stuck with me. The carrier handed over the most personal information he has, got nothing certain in return, and every other party in the chain still had a business model. I've worked in freight for more than 25 years, as a dispatcher, as a broker and building trucking companies. This article is about where carrier and driver data goes once it's handed over, and what carriers can reasonably ask before they hand it over.

What carrier verification asks for

Highway is a carrier identity and verification platform that many brokers use to onboard and vet carriers. Brokers set up their own requirements, and the carrier completes them to stay active with those brokers.

In our case, verification meant a government-issued photo ID and live facial images matched against it. Verification and onboarding requests across the industry can also include cab cards, insurance certificates and VINs.

My view: identity checks have a real purpose. Freight fraud is real, and I deal with it regularly. But every document a carrier hands over should have a clear reason behind it. If any platform or broker asks for financial documents such as a truck title or a loan agreement, it's fair to ask what that document has to do with verifying who you are, who will see it and how long it will be kept.

How the business model works, as I see it

This section is my analysis, not a statement of any company's terms.

In broker-facing verification, the broker is the paying customer. The carrier pays nothing in money, but provides the data that makes the service work. The carrier is the subject of the check, not the customer of it.

That doesn't make verification wrong. It does mean the carrier has the least say in how the system is designed, and the most to lose if the data is mishandled.

Is verification stopping fraud?

Cargo theft and freight fraud keep rising, despite wider use of identity verification. Verisk CargoNet publishes regular analyses of cargo theft that have reported rising losses, more confirmed theft incidents and sharp growth in fraudulent email attempts. Read their current reports for the latest figures.

Trade press coverage of freight fraud also describes thieves increasingly operating under real carriers' identities, using real authority rather than obviously fake companies.

My view: if criminals are using real carriers' identities, the industry should be asking where those identities come from. I'm not accusing any single company of being a source. I'm pointing to a simple risk: the more places a carrier's complete identity is stored, copied and handled, by vendors, sub-vendors and support teams, the more ways it can leak.

I've seen this from the inside. Logistical Forwarding Solutions has been impersonated by overseas fraudsters using our name against people who trust us. The people doing this are organized, and they go where the data is.

Where the data goes: what the privacy policy says

You don't have to take my word for any of this. Read the policy. Highway's privacy policy is public. Policies change, so check the current version, but the version referenced for this article disclosed that:

• Personal information may be processed outside North America, and when it is, it may be subject to foreign laws, including access by foreign governments.
• Data may be shared with vendors for purposes including identity validation, customer service and data enrichment.
• Identifiers may be shared with advertising partners.
• Data may be shared with corporate affiliates or transferred as part of a corporate transaction, such as a sale of the company.

None of those terms is unusual for a technology company. They are worth understanding when the data in question is a driver's license and a face scan.

The identity vendor behind the platform

Verification platforms often hand the biometric check to a third-party identity vendor rather than running it themselves. The privacy policy above describes sharing data with vendors for identity validation.

What to do: ask the platform which vendor processes your ID and facial images, then read that vendor's privacy policy too. Look for where data is stored, how long it's kept, whether it's on shared cloud infrastructure, and how you can ask for it to be deleted.

The questions carriers should be able to get answered

When a driver uploads his license and his face at a truck stop at 11 p.m., he should be able to find out:

1. Every company that receives the data, including vendors and sub-vendors
2. Which countries the data is stored or processed in
3. Whether support staff can view license images, and from where
4. How long the data is kept, in writing
5. How to have it deleted, and how deletion is confirmed
6. Who is responsible if the data is breached

My view: these are reasonable questions for any platform that holds biometric data, and the answers should be easy to find. If they aren't, that tells you something.

Everyone draws from the carrier

This section is opinion. Verification is one piece of a bigger pattern I've watched for decades. Almost every service in this industry depends on the carrier, and many of them bill the carrier in money, data or both.

Here's what a small trucking company gives up just to operate:

• Identity: license, face and biometrics, to vetting platforms and the vendors behind them.
• Location: the federally required electronic logging device (ELD) creates a running record of where the truck is, how it's driven and when the driver rests. Some onboarding processes ask carriers to share ELD login credentials with third parties. Be careful with that request.
• Finances: to factoring companies that advance invoice money for a fee, hold receivables and sometimes lock carriers into arrangements that are hard to leave.
• Margin: to the broker's spread. I've worked on both sides of this. In my experience, the spread can be much larger than carriers expect, and the carrier usually can't see it. Federal rules give parties to a transaction the right to review the broker's records under 49 CFR 371.3, though many contracts ask carriers to waive that right.
• Equipment data: to maintenance networks, insurance telematics programs and lenders.
• Subscriptions: to load boards that charge monthly to see freight the carrier then can't book until verification clears.

Each of these has a reason behind it on its own: fraud prevention, safety, cash flow, market access. Taken together, the small carrier pays into every layer and controls very little of it.

The long freight downturn pushed many small carriers out of business. The ones still running are the ones being asked for the most.

A choice that isn't much of a choice

This is my view, not a legal claim.

Can a carrier refuse verification? In theory, yes. In practice, refusing can mean losing access to the brokers who control the freight a carrier depends on. When the only way to keep working is to hand over something you'd rather keep private, it's fair to ask whether that's a real choice.

Brokers have their own reasons to want strong carrier vetting. Negligent-selection lawsuits, where a broker is sued over the carrier it chose, have made documented vetting a legal priority for brokerages. Platforms earn subscription fees, vendors earn processing fees and investors expect growth.

The carrier carries the data risk.

If you're a broker requiring verification

Brokers choose the platforms and set the requirements, so brokers can also set a better standard. If your brokerage requires carrier verification, consider:

• Asking only for what you need. Decide which documents actually answer "is this the carrier I think it is?" and turn off the rest. A title or loan agreement rarely belongs in that list.
• Reading your vendor's data terms. Know where carrier data is stored, which sub-vendors handle it, how long it's kept and who can view it. You're asking carriers to trust that chain.
• Telling carriers plainly what you collect and why. A short, written explanation on your carrier packet saves time and builds trust.
• Giving carriers a way to ask questions. Name a person or an email address that answers data and verification questions.
• Keeping a manual review path. Some legitimate carriers will fail an automated check for ordinary reasons. Have a way to verify them by phone, through FMCSA records and through their insurance agent.

Good vetting and respect for carrier data can work together. Brokers who do both will find it easier to keep good carriers.

It starts with the carrier

I teach circular thinking. Every dollar in this industry, from broker margins and factoring fees to insurance premiums and software subscriptions, starts with a driver turning a wheel. No carrier, no load. No load, no broker. No broker, no platform.

I'm not against verification. A system the industry can trust would:

• Publish a plain map of where carrier data goes and who can see it
• Keep the data only as long as it needs to, and delete it on request
• Limit who can view license and face images, and log every access
• Explain what each requested document is for
• Accept responsibility when the system fails

And it would be measured by one question: is the carrier safer, or more exposed?

What carriers can do now

• Read before you upload. Read the platform's privacy policy and the consent screen. Save a copy.
• Ask the questions above in writing and keep the answers.
• Share only what's needed. Don't hand over ELD logins, titles or loan documents without a clear reason.
• Watch for impersonation. Search your own company name, MC and DOT numbers from time to time, and tell brokers how to reach you through verified contact details.
• Report fraud through the official channels listed in our freight fraud resources.
• Get help with a broker problem. If a broker hasn't paid you, double brokered your load or used your authority, you can file a free, private complaint through FreightBrokerComplaint.com. A person reviews it, the broker gets a chance to respond, and nothing is published.

Freight University covers carrier vetting, fraud warning signs and how to read broker and platform terms in its free training. If you'd like help keeping your compliance and back office in order, talk with us.