Your Store Security Code

TL;DR

Your store has a five-digit code that only you and TORO can see. When somebody calls saying they're TORO Support, they tell you the code and you check it against your screen. If it doesn't match, it isn't us — hang up. You never read the code out loud to anyone, ever. Find it under Help ▸ View Security Code, or on the Dashboard under the Store tab. It changes on its own every 15 minutes.

---

Some of this arrives with your next update. The screen described below — the big code on its own page, the code disappearing the moment it expires, and Generate New Code working without a confirmation box — is on its way to your shop. If your screen still looks a little different, it is not broken and you are not missing anything. Everything about how to use the code is true today.

Here's a problem every shop with a POS eventually meets: the phone rings, someone says they're from TORO Support, and they need you to do something. Read them a number. Click a thing. Let them onto the computer.

Most of the time it really is us. But you have no way to know that, and "sounds like they know what they're talking about" is exactly the skill a scammer sells. The people who do this for a living are good at it, they're polite, and they call shops like yours because a cigar store has card terminals, customer records and cash.

So we gave you a way to check.

How it works

Your store has a five-digit code. You can see it on your own register. TORO Support can see it too — and nobody else can.

When we call you, we say the code first. You look at your screen. If the numbers match, you're talking to TORO. If they don't, you're not.

That's the whole thing. One number, checked in three seconds, and the most common way shops get talked into something expensive stops working.

Where to find it

Two ways, whichever is closer:

• Help ▸ View Security Code in the menu along the top.
• Dashboard ▸ Store tab ▸ View Security Code.

Either one opens a window with the code in large type, and a line underneath counting down to when it changes.

The rule, and it only goes one way

Never give this code out. Not to anyone, for any reason. Not to TORO Support, and not to Kosta.

We will never ask you to read it to us. We already have it — that's the entire point. Anyone asking you to say your code out loud is telling you they can't see it, which tells you exactly who they aren't.

So:

• ✅ They tell you the code. You check it.
• ❌ You tell them the code.

If somebody pushes back on that — says they need you to confirm it, or that their system is down, or that they'll read the first three digits if you read the last two — that's the moment to hang up. A real TORO tech will never put you in that position, because a real TORO tech can just read it off their own screen.

If the code doesn't match

Hang up. You don't owe a cold caller an explanation.

Then post in your store's WhatsApp support group and tell us what happened. TORO Support always reaches you in that group, never any other way — so a "TORO" call, text or email that didn't come through it deserves suspicion from the start. Don't call back on a number they gave you. If it really was us, we'll carry on in the group.

Nothing bad happens by hanging up on a real support call. Quite a lot can happen by staying on a fake one.

It changes by itself

The code rolls over every 15 minutes, and the window shows you how long the current one has left.

That means a code somebody overheard last week is worthless, and it also means a code can change while you're on hold.

You can't be caught out by that any more. The moment a code expires, TORO takes it off the screen rather than leaving a dead number sitting there, and shows GENERATING CODE until the new one arrives — usually a second. So a number on that screen is always a live one.

If it can't reach TORO to get the new code, after a few tries it says FAILED TO GENERATE CODE. It keeps trying in the background, but treat it the same as not being able to open the screen at all: if you can't see a code to check a caller against, don't give them anything. Hang up and reach us in your WhatsApp group.

Making a new code on purpose

There's a Generate New Code button if you want a fresh one immediately — worth doing if you think someone saw your screen, or if a customer was standing where they could read it.

It happens the moment you press it — there's no "are you sure?". That's worth knowing before you go looking for the button on a busy counter, because the old code stops working instantly. If TORO Support is reading you a code at that exact moment, it'll stop matching and you'll think you're being scammed when you aren't.

So: if you're mid-call, finish the call first.

The screen opens with Close already selected, so tapping Enter or the space bar closes it rather than making a new code. You have to press Generate New Code deliberately.

Once the new code appears, TORO tells you to let TORO Support know to refresh, so they pick up the new one. Do say it out loud on the call — nothing tells us automatically, and until we refresh we're still reading your old code.

Who can see it

Anyone who can get to the Help menu or the Dashboard. That's deliberate — the person who answers the phone is often not the owner, and they're the one who needs to check the caller.

It's safe to leave it that way. Seeing the code doesn't let anyone do anything; it only lets them check somebody else.