<p>Air cargo identity fraud has emerged as a structurally distinct threat within the broader cargo crime landscape. This paper documents the commercial mechanisms through which fraudsters identify, target, and successfully execute identity-based theft of high-value air cargo, mechanisms simultaneously visible from the freight forwarder pricing desk and the cargo acceptance counter, yet, to the authors’ knowledge, not previously documented in the published security and logistics literature. A practitioner observation methodology, grounded in reflective practice (Schön 1983), the insider research tradition (Brannick and Coghlan 2007), and analytic autoethnography (Anderson 2006), draws on 19 years of multi-carrier operational experience across three institutional lenses: cargo acceptance operations (DHL Global Forwarding), commercial pricing (DB Schenker), and route-level data analytics (Turkish Airlines Cargo). Theory development follows case-based theory-building logic (Eisenhardt 1989; Yin 2018). Throughout the paper, practitioner-derived observations are explicitly distinguished from independently documented evidence. This methodology is consistent with companion research (Kanwal and Abbas 2026a; 2026b). Three commercial targeting mechanisms are identified: (1) rate quotation intelligence exploitation through business email compromise vectors; (2) Known Shipper credential manipulation leveraging compressed air cargo time windows; and (3) high-value corridor targeting from analytics-derived shipment intelligence. Each mechanism exploits information generated during legitimate cargo commercial operations. Documented mechanisms are grounded in verified incident records from FBI enforcement actions and industry data; practitioner-observed patterns are identified as such. The practitioner observation framework generates pattern-level insight rather than statistical frequency data, and its findings are analytically rather than statistically generalizable. Cross-carrier AWB-level validation of detection models would require controlled data-sharing partnerships not yet established. The paper proposes a conceptual multi-dimensional detection architecture, grounded in the commercial data environment where fraud targeting originates as the basis for inter-institutional fraud prevention infrastructure. The architecture is specifically designed to address gaps identified by the U.S. Senate Commerce Committee (2025) and the FBI’s April 2026 public advisory on cyber-enabled cargo theft. To the authors’ knowledge, this paper offers the first documentation of the commercial pricing signal as a fraud targeting intelligence source; a dimension requiring simultaneous visibility into the pricing workflow and the acceptance security environment that was not identified in the literature reviewed for this study.</p>