Newbuild identity theft is the latest deceptive shipping tactic
- Sanctioned shadow fleet tanker using the IMO number of aframax under construction
- Tanker has history of IMO fraud, hijacking dead and live IMO numbers
- Instances of identity theft have increased in frequency and complexity over past year
It is a ‘significant escalation’ in identity theft that is harder to spot than the more common practice of becoming a ‘zombie’ tanker
The first known case of newbuilding identity theft has emerged, with a sanctioned aframax posing as a tanker still under construction in a Chinese yard.
Frunze (IMO: 9263643) is using the IMO number IMO: 1123081, which belongs to an aframax being built by Wanlong Shipbuilding Heavy Industry in Taizhou City.
An IMO number is a permanent and unique identifier assigned to ships for identification purposes. The numbers are issued by S&P Global on behalf of the IMO.
The IMO number of the newbuilding was first transmitted in Automatic Identification System messages in July, alongside the name Cordula and an identification number indicating the ship is flying the Tanzania flag.
Cordula sailed to China, where it went offline, returning to active AIS transmissions in mid-September.
The tanker can be tracked to the Singapore Strait and area off Malaysia, a known transhipment hub for Iranian and Russian oil, where it periodically manipulates its AIS data to show fake positions and voyages.
SynMax Intelligence identified the imposter as Frunze, a tanker designated by the US, UK and EU.
Frunze is no stranger to IMO fraud.
A previous Lloyd’s List investigation revealed Frunze adopted a new identity after being sanctioned in October 2024, at the time using the IMO number of a scrapped vessel, Symeon IV (IMO: 9292993) and going by the name Skyrill.
It later ditched its “zombie” identity, with SynMax analysis showing Frunze transmitting as Thea and the IMO number of a non-sanctioned shadow fleet* tanker, North Star (IMO: 9231468) in August 2025.
Identity fraud cases have increased in frequency and complexity over the last year to satisfy the sanctioned community’s demand for “clean” identities.
Vortexa’s director of maritime risk and intelligence Claire Jungman, who first identified Cordula, said the use of the IMO number of a vessel still under construction is a significant escalation in identity theft tactics.
“Unlike a scrapped vessel, an under construction IMO is not expected to transmit AIS or appear in operational databases, which reduces the chance of immediate detection,” Jungman explained.
“The motivation is plausibly to exploit that ‘clean’ identity window — it allows the tanker to appear legitimate on paper while avoiding conflicts with historical AIS tracks, inspections, or port records.”
In that sense, she says, this method can be more effective than reusing the IMO number of a scrapped vessel, which would often carry a visible operational footprint and red flags.
