The Federal Motor Carrier Safety Administration (FMCSA) requests your assistance in amplifying this important message regarding a new phishing fake email.  

The agency is aware that an email is being sent to registered entities by a party pretending to be FMCSA and requesting that carriers complete forms attached to the email. Those forms ask for a social security number and USDOT PIN. FMCSA does not require such information on official FMCSA forms. Carriers should NOT fill out forms attached to the fake email, and always refer to the official FMCSA forms for the latest and official documents. In some cases, the phishing attempt also asks for a certificate of insurance and driver’s license to help protect the recipient against fraud.  There is also a threat that if the recipient does not respond within a day, the individual will be fined, which is also not an FMCSA practice as part of the registration process. 

The fake email originates from either safety@fmcsa.gov, filing@fmcsa.gov, dotfilings@fmcsa.gov or audit@fmcsa.gov, none of which are legitimate email addresses and are NOT used or owned by FMCSA.  Next, if the recipient replies to the email, their message actually goes to @fmcsa-safety-fmcsa.com, which is also NOT a domain owned or used by FMCSA. Not only is some of this information Personal Identifiable information (PII), but this information would also allow the unauthorized party to gain access to  the recipient’s FMCSA account. The fake email containing the phishing link appears very convincing that the correspondence is from FMCSA. Screenshots of the fake email can be found on FMCSA’s website.

Communications from FMCSA relating to information requests of this type would either request individuals to log into their portal account at FMCSA Login (dot.gov), or the email would come directly from an FMCSA dedicated mailbox. While these emails typically end in “.gov”, we encourage our stakeholders and customers to verify any email or communication they feel to be suspicious with the appropriate agency.

Here’s What Individuals Can Do:

• Do not click any suspicious links, hover over them to see the real email address of url of that link. Click only on links you deem trustworthy
• Visit the Cybersecurity & Infrastructure Security Agency for more guidance on online deceiving tactics. Learn more about phishing
• The Federal Trade Commission (FTC) recommends following certain procedures for email verification. 
• File a complaint with the Federal Bureau of Investigations (FBI) by using their IC3 site
• Reach out to the FMCSA Contact Center or call (1-800-832-5660) if you are the target of these practices