FMCSA Motus Phishing Advisory: 4 Fake Registration Domains Named & Biennial Update Enforcement Paused

Key Takeaways

Official FMCSA Phishing Advisory: Motus Portal Impersonation

On September 15, 2026, FMCSA warned motor carriers, brokers, and freight forwarders that cybercriminals have launched sophisticated phishing campaigns impersonating the agency's new registration platform, Motus. The Motus system was launched on May 19, 2026, to consolidate legacy registration databases behind Login.gov authentication. However, fraudulent actors are exploiting carrier confusion surrounding the transition to extract credentials and carrier access codes.

According to FMCSA's advisory, the scam emails typically arrive with subject lines such as Notice of Required Off-Cycle Update- Motus email (or variants using em-dashes). The messages urge carriers to complete an urgent "off-cycle update" to maintain active status and feature a prominent button labeled "New MOTUS Portal." Sample screenshots released by federal investigators date elements of the campaign back to August 20, 2026, indicating the operation has been active for weeks.

FMCSA emphasized that bad actors are attempting to direct carriers to unauthorized third-party commercial websites designed to mirror federal portals. Carriers that enter credentials or carrier access codes on these sites face serious security risks, including unauthorized account modification and identity theft.

Domain Comparison: Official Motus Portal vs. Impostor Sites

To assist compliance officers and fleet managers in identifying fraudulent communications, the comparison table below details the single official government domain alongside the four fraudulent impostor domains identified by FMCSA:

Critical Verification Tells

• The Top-Level Domain Tell (.dot.gov vs .com): Official federal registration portals operate exclusively under the .gov or .dot.gov top-level domain. FMCSA never uses .com, .net, or .org domains for registration management.
• The All-Caps Capitalization Tell: FMCSA explicitly noted that Motus is a proper noun, not an acronym. Official communications write the name as Motus (capitalized initial letter). Fraudulent emails, buttons, and titles frequently write the name in all-caps as MOTUS.
• Off-Cycle Update Demands: FMCSA does not issue unsolicited emails demanding immediate "off-cycle updates" under threat of instant inactivation via third-party web buttons.

What the Biennial-Update Enforcement Pause Covers (and What It Does Not)

Alongside the phishing advisory, FMCSA issued critical clarification regarding the enforcement of biennial update filings (traditionally completed via Form MCS-150). Following technical stabilization issues and customer service backlogs associated with the May 19, 2026 Motus rollout, FMCSA enacted a temporary enforcement suspension effective September 10, 2026.

What the Enforcement Pause Covers

• Biennial Update Filings Due On or After June 1, 2026: Motor carriers, freight forwarders, and brokers whose scheduled biennial updates fell due on or after June 1, 2026, are protected under the enforcement suspension.
• USDOT Number Inactivations Suspended: FMCSA has temporarily halted administrative inactivation of USDOT numbers resulting from missed biennial updates for filings due on or after June 1, 2026.
• Duration of Relief: FMCSA has not established an end date for the enforcement pause. Relief will remain in effect while the agency conducts "recovery and stabilization efforts" on the Motus system. FMCSA stated it will publish advance follow-up guidance before resuming enforcement.

What the Enforcement Pause Does NOT Cover

• Filings Due Before June 1, 2026: Biennial updates that were overdue prior to June 1, 2026, are not covered by this temporary suspension and remain subject to standard compliance action.
• Permanent Exemption: The pause is an administrative suspension during system stabilization, not an elimination of the statutory requirement. Carriers will still be required to complete their updates once FMCSA issues follow-up guidance.
• State-Level Requirements: State licensing agencies, intrastate vehicle registration offices, or local weight distance tax filings may enforce independent state updates that are not affected by federal FMCSA pauses.

3-Step Verify-Before-You-Click Checklist for Carriers

To protect your fleet's administrative data and credentials from ongoing phishing operations, follow this three-step verification workflow prior to acting on any registration email:

1. Step 1: Inspect the Destination URL in Your Browser Address Bar.
   Hover over any link or button in the message before clicking. Confirm that the URL host starts with https://motus.dot.gov. If the address contains .com, datasboard, datadesk, webdeck, or function, delete the email immediately.
2. Step 2: Check for Capitalization and Subject Line Red Flags.
   Look for subject lines alleging an "Off-Cycle Update" or buttons styled with all-caps MOTUS. Official agency notices write the platform name as Motus and direct users to federal Login.gov authentication.
3. Step 3: Access the Portal Directly via Bookmark or Official Contact.
   Never click links embedded inside unsolicited email notifications. Navigate directly to https://motus.dot.gov by typing the URL into your browser or accessing saved government bookmarks. For verification assistance, contact the FMCSA Customer Service Center directly at 1-800-832-5660 (extended hours: 8 a.m. to 11 p.m. ET weekdays).

Insurance and Underwriting Impact for Motor Carriers

The convergence of the Motus system transition, phishing scams, and the biennial update pause creates unique operational considerations for freight insurance, underwriting, and risk management.

Freight brokers, insurance underwriters, and shippers utilize automated API feeds to verify USDOT safety status and active authority prior to binding policies or tendering loads. Because FMCSA has paused USDOT number inactivations for updates due on or after June 1, 2026, carriers with pending biennial updates will remain in active status on official FMCSA databases during system stabilization.

However, compliance officers should take note of two key risk factors:

• Credential Theft Risk: If a carrier employee inadvertently enters access credentials on an impostor site (such as dot.motusdatadesk.com), malicious actors could alter carrier contact details, bank routing information, or insurance filing records. Fleet managers should immediately audit their Motus portal profiles if phishing exposure is suspected.
• Underwriting Verification: When renewing commercial motor vehicle coverage, brokers and insurers should confirm that any flagged biennial update date falling on or after June 1, 2026 is recognized as protected under FMCSA's September 10, 2026 enforcement pause.

For additional compliance analysis on federal customs and border enforcement actions impacting commercial fleets, see our detailed guide on CBP Form 5106 importer record voiding rules, the non-domiciled CDL court challenge overview, and ongoing regulatory news updates.

Frequently Asked Questions (FAQ)

Primary & Secondary Sources (Verified September 15, 2026):
• FreightWaves: FMCSA warns trucking companies about 4 fake Motus registration sites (Sept 15, 2026)
• Heavy Duty Trucking (TruckingInfo): FMCSA Pauses Biennial-Update Enforcement Amid Motus Transition (Sept 15, 2026)
• Official FMCSA Motus Portal (motus.dot.gov)