Cargo crime and the rise of the insider threat

The first quarter of 2021 continued to challenge organisations’ resilience and ability to react to changing security risks and threats. Various trends across the world negatively impacted the threat of cargo theft, with various types of thefts involving insider threat emerging and continuing in each region of the world.

In this report, BSI and NMU evaluated cargo threats seen in the first quarter of 2021, with a focus on the risk of insider threat while also highlighting key mitigation techniques organisations can implement to combat these types of risks.

Regional Summaries


A wide variety of tactics are involved in cargo theft incidents throughout Europe, and Germany, Russia, Italy, France, and the United Kingdom generally record some of the greatest number of thefts in the region. As noted early on in the COVID-19 pandemic, a higher than usual number of thefts continue to occur from warehouses and facilities. As a result of disruptions to movement caused by the pandemic, stockpiled goods and trucks parked outside of warehouses and facilities became easier targets for thieves. However, thefts from trucks parked along highways still occur regularly, exacerbated by the use of soft-sided trailers throughout the region. Targeted products remained generally the same throughout Europe, where thieves stole food and beverage, apparel and footwear, and electronic products most frequently in Q1.

In Russia, employees are often involved in thefts from warehouses and truck drivers are sometimes contacted by criminals to re-route deliveries to other locations. There are concerns in the United Kingdom that truck drivers are involved in thefts via the “rollover technique,” a tactic publicised in late 2020 after multiple thefts of high-value electronics from in-transit lorries.

Collusion is common in cargo thefts in Russia, and many countries in eastern Europe, and thieves use a variety of means and methods. Opportunistic individuals, often corrupt employees or former employees, and organised crime members are responsible for most cargo thefts in Russia. Most warehouse thefts involve a current or former employee of the victimised company. More professional thieves will offer fictitious logistics services in order to seize shipments, and data suggest this trend is growing in use. These sophisticated groups secure freight transportation jobs via false advertising online and steal goods from warehouses under the guise of legitimate shipping. Truck drivers have also reported being contacted while in-transit with a change in delivery location, offloading cargo at sites controlled by thieves.

Cargo thieves in the United Kingdom primarily conduct thefts by slash-and-grab from soft-sided trailers; however, they may use more refined means, at times utilising sophisticated tactics and insider information to conduct their theft operations. A growing tactic in the United Kingdom is the “rollover technique,” in which criminals in personal vehicles surround lorries carrying expensive, high-value goods such as electronics and tobacco. Once surrounded, often by three or more vehicles, the thief will climb into the back of the lorry, throwing the stolen goods into the trailing vehicle. In these thefts, there are concerns that the thieves may have insider knowledge when and where the high-value goods are being transported.

Middle East and Africa

Cargo thieves in the Middle East and Africa continue to primarily operate in South Africa, followed by Tunisia, Egypt, Saudi Arabia, and Lebanon. Cargo theft occurs more frequently in South Africa than in any other country, accounting for 30 percent of cargo theft incidents in the region.

While thieves in South Africa continue to predominantly hijack in-transit cargo trucks, thieves in the Middle East, especially in Lebanon, Saudi Arabia, and the United Arab Emirates, continue to primarily steal shipments of goods from facilities, potentially explaining the higher rate of facility thefts than hijackings across the Middle East and Africa in Q1. In the first quarter of 2021, cargo thieves stole food and beverage products, followed by automotive goods, alcohol and tobacco, fuel, and construction materials.

In the Middle East and Africa, insider participation occurs frequently in cargo theft. In the Middle East, especially in the Gulf countries, cargo theft incidents involve supply chain employees, such as cargo truck drivers in the case of Saudi Arabia and warehouse security guards in the case of the United Arab Emirates (UAE).

Cargo truck drivers in Saudi Arabia often participate in thefts by collaborating with organised cargo theft gangs to steal freight shipments. While most cargo theft incidents involving insider, participation occur while goods are in-transit and involve the truck driver, warehouse employees have also been known to participate in cargo theft incidents in the country, including thefts of high-value goods like pharmaceutical products and electronics. In one noticeable incident in the first quarter of 2021, a supply chain worker forged delivery orders for medicines and medical supplies to steal them from a warehouse.

Elsewhere in the Gulf countries, and particularly in countries with large warehouse districts, cargo thieves may bribe supply chain employees to circumvent the robust security programs in place in these locations. Opportunists in the UAE, for example, typically employees or security guards at warehouses, steal goods from facilities. Cargo thieves have also been known to participate in cargo crime by paying small bribes to security guards to gain access to these warehouses.


Cargo thieves in the Americas continue to operate most frequently in countries including Brazil, Mexico, and the United States. While Mexico and the United States saw either consistent or higher rates of theft last year, a combination of police operations and the more severe impact of COVID-19 in Brazil resulted in a drop off of incidents over the course of 2020. This decrease in overall incidents, however, is not enough to displace the country as the number one nation for cargo theft incidents in the Americas, as the overall number of cargo thefts is still high enough to place the country as the world’s leading hotspot for the risk.

While thieves in these countries continue to steal shipments of goods at an extremely high rate, particularly in comparison to other regions of the world, there has been some shift in the way thieves are carrying out thefts. In the United States in particular, an increasing number of incidents involved partial shipment theft or pilferage. Meanwhile, thieves in Mexico and Brazil continued to predominately carry out hijackings of in-transit cargo trucks. Other types of thefts in the Americas include those involving burglaries and robberies of facilities such as distribution centres or warehouses.

Food and beverage, following historical trends, led in the first quarter of 2021 as the top commodity stolen in the Americas. The ease of resale, more opportunities to steal such shipments due the higher volume of food products transported at any given time, and the typically lower level of security afforded to these types of shipments explains this trend. Other frequently stolen types of goods in the Americas during Q1 includes construction materials, which was in part buoyed by a spate of incidents occurring in the Dallas, Texas area of the United States. As commodity prices continue to rise, it is likely that certain types of goods, such as lumber and other construction materials, will continue to rank high among the most commonly stolen types of goods in the region.

Insider participation in cargo thefts in the Americas occurs frequently, with cargo truck drivers representing arguably the greatest risk, particularly in countries like Brazil. Drivers in this country often participate in schemes by either falsely reporting that the load they were transporting was hijacked, instead taking the goods for themselves, or in a modified version of this scheme will work directly with cargo theft gangs and deliver the shipments to them in exchange for a cut of the profits.

This type of theft is called turnkey theft, or “chave na mao,” and occurs commonly in Brazil but also Argentina as well. The use of this tactic tends to correlate with the sophistication of a cargo theft group, with one recent gang consisting of a highly organised 30 or so members. This method of theft includes thieves, posing as legitimate transporters, or corrupt drivers diverting shipments and then falsely reporting the shipment was lost during a cargo theft to out-of-state police to hinder detection. Gangs conducting turnkey thefts have stolen a wide range of goods, with no clear trend in the types of goods stolen. Although the relationship between corrupt drivers and cargo theft gangs may be more established in these turnkey thefts, the theft of goods by drivers occurs relatively commonly in Brazil.

Elsewhere in the Americas, and particularly in countries where corruption is widespread and criminal elements wield significant power, cargo thieves may bribe supply chain employees to handover or provide opportunities for gangs to access cargo. Organised criminals in Mexico, for example, have bribed train conductors in the past to stop in secluded areas ideal for breaking the seals on the rail cars and stealing the cargo. Insider knowledge has also likely played a key role in many of the more spectacular thefts that have occurred over the years in countries like Brazil and Chile. In these instances, highly sophisticated and well-armed gangs have invaded airports and have made off with high-value shipments of goods ranging from electronics to even gold. The efficiency to which thieves in these instances carried out the theft suggests that they were operating with insider knowledge of not only load details but also timing of shipment arrivals. These cases highlight the extent to which insiders can influence the frequency and overall value of losses in cargo theft incidents in the Americas.


Cargo theft occurred more frequently in India than any other country in the region for Q1 data, making up over two-thirds of all reported incidents. This is likely driven in part by the ongoing COVID-19 crisis in the country and the numerous local and state lockdowns increasing demand for various goods, especially food. The most targeted good for cargo theft by product type in India is food and beverage, composing more than one-third of all reported incidents.

Incidents of cargo theft in China, primarily involving warehouses and logistics facilities, have involved the complicity of an employee with intimate knowledge of company operations that often exploits gaps in access controls. These thieves generally pilfer small amounts of items, ranging from electronics to herbal medicines in these most recent cases of theft, but occasionally manage to steal large quantities of goods.

There is also considerable risk of supply chain corruption in India, especially among private supply chain employees. Warehouse employees have been known to steal goods from the facilities by sneaking into the building during afterhours. It is also common for corrupt cargo truck drivers to assist in diverting shipments intended for export from the country to warehouses controlled by cargo thieves.

Mitigating the risk

We have seen an increasing number of cargo thefts and ‘targeted jobs’ where thieves are able to gain insider knowledge that allows them to exploit vulnerabilities and aid criminals’ objectives. In these ‘targeted jobs,’ thieves likely had advanced insights into movements, routes, products and their value, volume, and ways to circumvent protective measures. As organisations implement improved physical, procedural, and cyber security measures, criminals may be more inclined to recruit or implant insider threats within organisations. Insiders can be a full-time or part-time employee, a contractor or even a business partner; and may either deliberately look to assist criminals or be recruited, or act as personal or financial circumstances change – creating a new motivation. Although the scope of this threat is wide, there is a clear linkage between an insider act taking place and exploitable weaknesses in an employer’s protective security and management processes.

At the organisation-level, there are various vulnerability factors and exploitable weaknesses, including but not limited to: poor management and supervisory practices, poor or inconsistent use of auditing functions, lack of protective security controls, poor security culture, lack of adequate, role-based, personnel security risk assessment, poor or no pre-employment screening, and a lack of awareness of people risk at a senior level.

Organisations should consider the following risk mitigation recommendations to protect cargo from insider threats:

  1. Implement multiple layers of defence, starting with physical security but also implementing management-level procedures and policies.
  2. Conduct pre-employment screenings to obtain information about prospective or existing staff and use that information to identify individuals who may present security concerns. Pre-employment screenings can also be used to establish whether the applicant has concealed important information or otherwise misrepresented themselves. Thus, this allows you to confirm the identity and credentials of those you are granting access to your sites and information and reduces the likelihood of an insider harming your business.
  3. Regular performance reviews should be undertaken to determine any potential change in personal circumstances and conduct frequent awareness briefings and training programmes to educate all employees on best practice. This includes implementing a sound communication policy both internal and external considering the use of mobile devices and social media.
  4. Guard information about physical security and giving out details should be avoided whenever possible. For example, information around the site CCTV coverage and usage could be damaging, and information as to when security equipment is under maintenance or down time should be closely guarded. Any known weaknesses in terms of security, such as a damaged fence, should also remain tightly guarded.
  5. In regards to insiders giving criminals information about the type and processes for movement of goods, restricting information will prevent individuals developing a sound understanding of your operations and make it increasingly difficult for perpetrators to circumvent your security measures. Knowledge of and access to cages within warehouse facilities storing high value or bonded cargoes should be severely restricted. Cargo arrival and dispatch information may appear to be low value data, however can prove extremely valuable to the perpetrators of theft. Divulging this type of information can result in perpetrators developing knowledge as to what cargo is loaded on which vehicles, when they are leaving site and the likely immediate route to be taken, affording them the opportunity to track and target cargo for theft.
  6. Where alarms are in place, the location of the control panel and alarm access codes should be closely managed.

The expert view

David Fairnie, BSI Principle Consultant, Supply Chain Security

“This threat is one that all employers are vulnerable to. People are an organisation’s biggest asset; however, they can also pose an insider risk in some cases. As organisations implement increasingly sophisticated physical, procedural and cybersecurity measures to protect their assets from external threats, the recruitment and infiltration of insiders become a more attractive option for those attempting to gain access illegally.

“The application of sound ongoing personnel security principles adds enormous value to physical and technical security measures cost-effectively, promoting good leadership and management and maximising people as part of the security solution to mitigate the insider threat.”

Ian Allman, NMU Risk Control Manager

“There is clearly a changing landscape in cargo crime across the globe and criminals embedded within organisations is now commonplace, particularly in those businesses that rely heavily on temporary / agency staff during busy periods. It is no longer sufficient just to build defences from the outside inwards, because it is highly likely that the security perimeter has already been breached. Control of access to information regarding the movement of cargo is now a vital part of any security management system as is the selection and monitoring of personnel who have access to that information.

“Whether people(s) are complicit or coerced, the ‘insider threat’ is real and leakage of what may seem the most trivial piece of information, can aid organised criminal gangs to steal cargo.

“Equally, staff may be unaware they are being specifically targeted to release information, so security awareness training (e.g. importance of document security) should now form part of a business’s defence against this type of attack.”

Prevention is better than cure!

Our collaboration with BSI Supply Chain Services and Solutions enables NMU brokers to further support clients, through leveraging the consultative partnership, to better understand their supply chain risks to address potential areas of vulnerability.

With BSI’s vast experience in supply chain security and risk management and our understanding of the cargo and freight liability insurance industry, this partnership will provide NMU policyholders with the necessary knowledge and skills to take a proactive approach to becoming more resilient in their supply chain operations, as well as helping to reduce losses and claims.

Contact us

For more information about Risk Control or Cargo Insurance, contact your NMU Development Underwriter.

© Copyright NMU/BSI 2021

Sign up to receive our content via email

If you’re not already receiving our Risk Control Bulletins and reports via email, NMU insurance brokers can sign up to download the report and receive future exclusive cargo crime content in partnership with BSI, using the form here or use the QR code below.

By completing this form, you are opting in to our mailing lists and you agree that we may add your details to our database and use them to send you the updates and information you have requested, in accordance with our Privacy Policy.

Related tags


News: War and Strikes Risks Update | 22nd June 2022

Although various risk scores have been updated this month – as they are every month – there... read more


News: A Review of Cargo Crime in 2021

In 2021, the evolving supply chain landscape, characterised by a pandemic, an opening up of the economy... read more


News: Wellness days – 16th and 17th June

Since 2020 we have given our colleagues well-deserved wellness days, where we encourage everyone to take the time out... read more