The fake government website already knows your company. Enter a USDOT number, and it returns your business name and address. Then comes the warning: your operating authority is not authorized, and you need to authenticate your payment method.
That apparent familiarity is the trap. Abnormal researchers found attackers using public carrier records to manufacture credibility, then channel fleet administrators toward counterfeit fuel-card login pages.
The Federal Motor Carrier Safety Administration's fraud alerts warn of fake SAFER and MOTUS communications, including requests to verify payment and fuel systems tied to MC/DOT numbers. Our research goes behind those warnings to show how the sites qualify targets, collect information, and pursue accounts with direct financial value.
Why Fuel Cards Are Worth Stealing
Fuel cards connect a familiar business task to a financial target. They fund the purchases that keep commercial fleets moving. A compromised administrator account can give a fraudster a foothold in that payment system, with opportunities for unauthorized fuel purchases depending on the provider, account permissions, and transaction controls.
The pretext also fits the audience. Someone responsible for a carrier record may reasonably care about an authorization warning and have access to fleet payment information. The scammers exploit that overlap, presenting a request for commercial account credentials as the solution to a regulatory problem.
Fuel provider WEX identifies account takeover through phishing and social engineering as a major fuel-card fraud risk. Our investigation establishes credential harvesting; it does not establish how much fuel was stolen or how many accounts suffered losses.
Public Data Provides the Proof
In the earlier campaign, tracked as Saderson_DOT, the counterfeit SAFER application carried approximately 102,500 public carrier records inside its JavaScript bundle. Entering a matching USDOT number produced the carrier's real legal name and address, followed by a fabricated authorization warning.
The deception works by demonstrating knowledge of the business before requesting anything sensitive. Accurate public information makes the false status warning feel specific and authoritative. No government database breach is required.
The portal then offers fuel-provider choices and sends visitors to separate lookalike login sites. Researchers captured forms impersonating EFS, TCS Fuel, Comdata, and iConnectData. The attacker borrows government authority to make an unrelated payment-account login appear necessary.
The Attacker Records Interest Before Collecting Passwords
The collection pipeline begins earlier than the final login form. In the Saderson_DOT kit, validating a USDOT number triggers a request to a server-side Telegram forwarding endpoint. Further interactions generate additional requests as the visitor progresses toward credential submission.
A carrier that stops before entering a password may therefore still have signaled interest to the attacker. That is evidence of engagement, not proof of an account takeover, but it gives responders a reason to investigate beyond the final submission screen.
The name Saderson appears in the kit's forwarding messages. Researchers captured a Telegram account using the matching handle, shown below. That connection helps explain the research label; it does not establish a real-world identity or prove who deployed each site. Backend source, destination chat identifiers, and an operator dashboard were not recovered.
MOTUS Adds a Verification Call to the Deception
Our October research identified the same fuel-card harvesting kit behind a rebuilt MOTUS Carrier Services portal. Matching code, distinctive stylesheet markers, and the same Telegram forwarding interface connect the harvesting components across generations. The front end changed while the machinery collecting credentials remained reusable. That code relationship does not establish that the same person operated both campaigns.
A newer variation adds a human conversation. A fake FMCSA scheduling page asks for the company's fuel provider and provider account or customer ID, then offers a verification call by phone, Microsoft Teams, or email. It reassures visitors that the page never asks for provider passwords.
That reassurance is part of the deception. A visitor can disclose account information and agree to further contact without encountering a password field. The scheduler creates an opportunity to continue the social engineering through a conversation; the captured page does not establish what happened on subsequent calls. Awareness guidance limited to suspicious login forms can miss this earlier handoff.
The infrastructure remains disposable. Fresh domains and Vercel-hosted portals give the operation replaceable fronts, while server-side Telegram forwarding supports information collection. Defenders need to recognize the verification workflow as well as individual websites.
Exposure Extends Beyond Transportation Companies
The earlier Saderson_DOT research documented more than 10,000 messages reaching over 1,300 Abnormal-protected organizations during a five-week window. The newer MOTUS wave accounted for roughly 10,300 messages to about 589 organizations across US and European mail environments from August through October 2026, using around 300 sender domains. These are separate observation windows, not a combined victim count.
Observed MOTUS delivery included manufacturing, construction, wholesale, agriculture, oil and gas, and logistics alongside trucking. These figures measure exposure, not successful fraud. Organizations across industries operate fleets and employ administrators with access to fuel accounts, putting the potential target population well beyond transportation companies.
Breaking the Connection Between Credibility and Access
Fleet and compliance teams should verify status concerns through independently accessed government systems and use established bookmarks for fuel-provider accounts. Treat unsolicited verification calls about fuel accounts with the same scrutiny as login requests. Correct company details are not proof that a portal is legitimate. Enable provider-supported multifactor authentication and coordinate suspected compromise across security, finance, and fleet operations.
These scams turn open records into personalized pressure and regulatory concern into a request for payment credentials. Recognizing that connection helps organizations protect the people responsible for keeping their fleets moving.