Wanted to caution others about an experience we just had with Toast Support. We had filed several tickets related to a systems issue. Within several hours of filing the ticket, we received a call on our main line by an individual claiming to be Toast Tech Support responding to our tickets. He then directed us to take actions which allowed him access to our account which he later used to request a $1000 instant deposit to a debit card. After the interaction, we called Toast, feeling a bit uneasy about the interaction. Support directed us to immediately delete emails, change passwords and created a case with the Fraud department. I raised the concern that the Hacker somehow knew that we had just created cases requesting tech support. I thought this fact would be of particular interest to Toast as it could indicate some vulnerability in their systems that the Hacker was able to exploit in contacting us. I know we were lucky, it could have been much worse and had I been more tech literate myself, I would have suspected the individual was not who said he was earlier in our conversation before the damage was done. We weren't asked to share passwords but were directed to perform actions that exposed our information. I am writing this to share our learning, as embarrassing as it is to admit we fell for the scheme. (We will now ask for full names, call back information and employee number for our interactions with Toast Tech Support). I also hope that Toast's fraud department will investigate this event, question us about our experience , as well as others that have occurred to look for vulnerabilities in their systems. I don't think it was a lucky coincidence that the Hacker knew we had technical tickets that had not been addressed. Toast is a quality firm and I continue to add product and subscriptions at my two locations. I can only hope that Toast is doing everything they can to protect my information, and that of my customers.
