Free TORO Insight: Help Us Stop Scammers

TORO Security Code

🚫 NEVER give your security code to ANYONE. Not even TORO. Not even Kosta.

TORO must ALWAYS give YOU the code. You check it. You never say it. If someone asks you for your code, they are not TORO. Hang up.

Where to find it: On your POS Dashboard, open the New in TORO tab and click TORO Portal Setup. Then open insight.torocigarpos.com on your phone.

Do these 3 things today

1. Make your login. On your POS Dashboard, open the New in TORO tab and click TORO Portal Setup. Type a username, email and password, and click Create Account. Write the password down.

2. Put TORO Insight on your phone. Go to insight.torocigarpos.com and sign in.

iPhone: in Safari, tap Share, then Add to Home Screen, then Add.
Android: in Chrome, tap Install App (or ⋮ menu, then Install app).

3. Make TORO give YOU the code. Every time. When anyone says they're from TORO, even Kosta, ask: "What's my store's security code?" They say it. You check it on the Store tab in Insight.

It matches: it's really TORO.
They can't tell you, or it doesn't match: hang up. Give them no information and no access to your computer.
They ask YOU for the code: hang up. TORO will never ask. We already have it.

Remember: TORO Support only ever contacts you in your store's WhatsApp group, and Kosta only ever calls you on WhatsApp. Never a regular phone call, never any other way. Even on WhatsApp, ask for the code.

Bonus: the same username and password also signs you in to portal.torocigarpos.com, where you can see your TORO billing and send us ideas for things you'd like TORO to build.

Why we're doing this

On September 21, 2026, a scammer called several TORO stores, said he was from TORO, and told them he needed to "calibrate the credit card terminal."

That is not something TORO does. He wanted access to the store's computer and card terminal, and he sounded convincing.

Calls like that are going to get more common, and they're going to get better. AI can now copy a voice, make up a believable story, and call a hundred shops in an afternoon. What a scammer can't do is give you a number that only you and TORO can see. So we're giving every store that number, free, on the phone in your pocket.

Yes, AI can sound exactly like Kosta

This is the part that surprises people, so here it is plainly.

Today, anyone can copy a person's voice with AI using a few seconds of recording: a voicemail greeting, a video on social media, a clip from a trade show, or a short phone call where they got Kosta talking. Once they have the voice, they can type anything and it comes out sounding like Kosta: the same accent, the same way of talking, even saying your name and the name of your shop.

And it isn't only the voice:

Caller ID can be faked. A call can show "TORO" or a number you recognise and come from anywhere in the world.
WhatsApp accounts can be faked. Anyone can make a new WhatsApp account with Kosta's name and Kosta's photo.
They can know things about you. Your store name, your address, that you use TORO, even the name of an employee. A lot of that is public, and the rest can come from an earlier call.

So "it sounded just like Kosta" proves nothing any more. Neither does the caller ID, the profile photo, or how much they seem to know.

The one thing they can't fake is your security code. It changes every 15 minutes and only your store and TORO can see it. That's why the code applies to everybody, Kosta included. Kosta will give you the code on every call and won't be offended when you ask. Kosta wants you to ask.

What Free Insight gives you

TORO Insight is now free for every TORO store. The free version does two jobs:

Your store security code. It sits at the top of the Store tab. It's a five-digit number that changes on its own every 15 minutes, and only your store and TORO Support can see it.
Access request approvals. When an employee at the register needs permission to do something, like a void, a price override or a discount, the request comes to your phone. You approve or deny it from wherever you are, so nobody has to call you and nobody has to share a password.

Want live sales, transactions, customers and the rest of the dashboard? Those come with the paid plans. See TORO Insight. You don't need them for anything on this page.

The account you create works in two places:

insight.torocigarpos.com is TORO Insight: your security code, access requests, and, on the paid plans, your live store numbers.
portal.torocigarpos.com is the TORO Customer Portal. Look over your TORO billing history, and submit ideas in the Think Tank for features you'd like to see built. We read every one.

Same username, same password, for both.

TORO Portal Setup is on the New in TORO tab of the Dashboard. Only admins see it. If you're an admin without a login, TORO also reminds you with a TORO Security Code message the first time you enter your password each day. Click Set Up Now there, or What Do I Get? to open this page first. Remind Me Tomorrow puts it off until the next day. It stops for good once your login is made.

Click TORO Portal Setup. If you don't have a login yet, the TORO Portal Account window opens.
Type in a username, a real email and a password. The checklist under each box turns green as you type. The password needs at least 10 characters, with an uppercase letter, a lowercase letter, a number and a symbol.
Type the password again to confirm it, and click Create Account.

Write the password down somewhere safe. TORO won't show it to you again.

Already have a login? TORO Portal Setup takes you straight to the TORO USER ACCESS screen instead, where you can see everyone's logins at your store.

Logins for the rest of your staff

Make a login for everyone who answers your phone, not just yourself. The person who picks up is the one who needs to check the caller.

From TORO Portal Setup (or the TORO Portal button in the bottom-left of the Dashboard), open TORO USER ACCESS.
Click the green Create User button, choose the employee, and fill in their username, email and password.
In Access, make sure Can use TORO Insight is ticked, then click Create User.

If Can use TORO Insight is greyed out, message us in your WhatsApp support group and we'll switch it on for you.

For the full walkthrough, see TORO Customer Portal.

Installing Insight on your phone, in more detail

Open insight.torocigarpos.com in your phone's browser and sign in. The first time, you'll be asked to accept the Terms of Service. Then add it to your home screen so it opens like an app.

iPhone

Open insight.torocigarpos.com in Safari. It has to be Safari, because other browsers on iPhone can't install it.
Tap the Share button (the square with an arrow pointing up) in the toolbar.
Scroll down and tap Add to Home Screen.
Tap Add.

Android

Open insight.torocigarpos.com in Chrome.
Tap Install App when it appears on screen, and confirm.
No button showing? Tap the ⋮ menu in the top-right corner, then Install app or Add to Home screen.

You'll now have a TORO Insight icon on your home screen. The install button is also in Settings (the gear icon) inside Insight.

The security code, in more detail

Anytime someone contacts you and says they're from TORO, ask them for your store's security code. Then open Insight, go to the Store tab, and compare.

If they can't tell you, or the numbers don't match: stop. Don't give them any information about your store, your customers or your accounts. Don't let them onto your computer. Don't click anything, install anything or read anything out to them. Hang up.

It works the same whether they call, text, email or show up at the door, and whether they sound like someone you've spoken to a dozen times or a complete stranger.

The code only goes one way

They tell you the code. You never tell them. Not TORO, not Kosta, not anyone.

A real TORO rep, and Kosta, can read the code off their own screen, so we will never ask you for it. If someone asks you to read your code to them, or offers to swap halves ("I'll say the first three, you say the last two"), that tells you they can't see it. Hang up.

If you've been waiting a while

The code changes every 15 minutes. If someone reads you a number that doesn't match and you've been talking for a while, refresh the Store tab once and check again before you decide.

For more, see Your Store Security Code.

How TORO Support will contact you

TORO Support will always reach you in your store's WhatsApp group. Kosta will only ever call you on WhatsApp. We will never contact you any other way.

Even when it is WhatsApp, ask for the code. A WhatsApp account with Kosta's name and photo proves nothing on its own.

So if "TORO" or "Kosta" calls your shop phone, texts your cell, emails you, or reaches you any way other than WhatsApp:

Ask for the security code.
If they can't give it, hang up.
Post in your WhatsApp group and tell us what happened. We want to hear about every one, because it helps us warn the other stores.

Never call back on a number the caller gave you. Use the WhatsApp group you already have.

Things TORO will never do

Call to "calibrate," "reset" or "update" your credit card terminal.
Ask you to read your security code to us. Not TORO Support, and not Kosta.
Call you on a regular phone line. Kosta only calls on WhatsApp.
Ask for your card terminal password, your bank details, or a customer's card number.
Hurry you, or tell you something bad will happen unless you act right now.
Contact you anywhere except your store's WhatsApp group.

If someone does any of these, it isn't us.

Fighting this together

Scammers win when they can sound like us. The security code takes that away. One question, checked in a few seconds, and the call is over.

Please share this page with everyone who works your register. The more stores that ask for the code every time, the less it's worth anyone's while to try.