Who can change the account your money lands in
Cargo theft in the US started at a login screen, not on the road. What it asks of whoever runs a business fits in one question: who can change the account your money lands in?
Whole trucks vanished between California and Texas. The headline everyone repeated was that the thieves cloned the tracker.
That is not where it started.
The theft happened at a login screen
Days before any truck moved, someone got into an account that was not theirs and changed a phone number on a registration form.
That number was the one the other company called to confirm who they were talking to. So they called — the thief. Checked, matched, released the load.
The tracker, if it was cloned at all, came last. The theft was already done.
The part that applies to any business
Take the truck out of the story and what is left is a sentence I wish every owner would read slowly:
A field the person could edit was being used as proof of who they are.
The check existed. It worked. And it was useless, because it verified exactly what the guy had just typed in.
Look around your business and they turn up in two minutes:
- the bank details for payouts, which finance checks before transferring
- the phone that gets the code when someone forgets a password
- the contact support reads out loud to "confirm it's really you"
- the email on an invite that decides who ends up with admin access
All of those are profile data. And all of them are standing in for a password.
The Monday question
It is not a technical question. It is an owner's:
Who, in my company, can change the account my money lands in — and does anyone check that another way?
If the answer is "the customer changes it and the system accepts", you do not have a check. You have a formality.
The difference between the two only shows up the day someone has a reason. And by then it is late: the money is gone, and the paperwork says everything was fine.
On the mat, the detail that decides the fight is not the pretty throw. It is what you check before you step in. Business is the same — checking is not distrust, it is the job.
The reporting on this case — what the FBI describes, what is industry estimate, and what is one investigator's word — belongs to the Silicon Village blog. There the case is taken apart; here I look only at what it asks of whoever decides.
