How To Protect Your Business From Toner Pirates and Other Scams

How To Protect Your Business From Toner Pirates and Other Scams

As cyberattacks continue to skyrocket, organizations around the world have been focusing on improving their cybersecurity and training their staff on how to recognize and report common phishing scams. That work is tremendously important, but in securing your data and infrastructure from new online threats, don’t forget about old-school scams that have been preying upon small businesses and nonprofits for years.

Way back in 1996, the Federal Trade Commission helped nine defendants in a “Toner Phoner” fraud case. The previous year, the FTC recovered almost $900,000 for small businesses that were defrauded in a similar office supply scam.

Office supply scams aren’t quite as old as the hills, but they’re probably older than some members of your staff. These scammers are still using their same old tricks because they’re still getting the same old payouts: back in 2000, the FTC estimated that toner pirates cost small businesses $250 million each and every year. Even in today’s dollars, that’s no petty theft.

Let’s explore how toner pirates operate, and how you can train your staff to spot their scams faster than you can say “Arrrrrrr.”

What Is a Toner Pirate?

A toner pirate is someone who pretends to be a legitimate supplier of toner, ink, or other office supplies. They might often offer you a gift of free supplies as an incentive for doing business with them. The supplies may or may not arrive; if they do arrive, they will probably be of poor quality or incompatible with your equipment.

Later, you will receive an invoice for supplies you never ordered, at a highly inflated rate. As many businesses don’t do a great job at tracking their print supplies, they’ll often pay these invoices before realizing they’ve been tricked. In fact, some scammers offer a special “discount” if you pay them quickly, and, of course, online.

Which Organizations Are Vulnerable To Toner Pirates?

Office supply scammers, or toner pirates, will often prey upon smaller businesses and nonprofits. Smaller organizations typically don’t have a tight rein on who is authorized to order supplies, and may not have a standard process for tracking their invoices.

The Anatomy of an Office Supply Scam

A scammer will often start by calling your company to get as much information about your equipment as possible. They could also try to find information about you, your business, or your staff online.

Once they find out this information, they’ll often contact you a second time to try to tempt you with discounted office supplies, with a promise of free ink or toner as an incentive. This call will often involve high-pressure tactics that encourage you to order quickly.

Even if you don’t fall for the second phone call and hang up on the scammer, you may still receive an invoice for products you didn’t order. The invoice will list unreasonable prices for these supplies, which you may not even receive.

Nine Signs You May Be Talking to a Scam Artist

Unlike phishing scams, which are growing more and more difficult to spot, old-school scams are much easier to recognize once you understand how they work. Here are some common clues that may indicate you’re dealing with a scammer:

  1. You’ve never heard of their company, and you can’t find them online. 
  2. They claim to be from a company you do business with, but they ask questions that the company would already know, like which equipment you’re using and your address.
  3. They claim to be from the company that manufactured your equipment, urging you to buy supplies immediately before prices go up. 
  4. They will use words and phrases like “Act now,” “Limited time,” “Urgent,” or “Free.”
  5. They will tempt you with amazing rates, but they won’t put those prices in writing.
  6. They may claim to be your regular supplier, but they’ve somehow lost track of some important information that they need you to verify.
  7. They use high-pressure sales tactics, and try to get you to buy supplies quickly, before you’ve had time to think.
  8. The person calling you will ask a lot of questions about your company but will not give out much, if any, information about theirs.
  9. They will offer you supplies for a ridiculously low rate, or lure you with the promise of free supplies.

What To Do If You Suspect a Scam?

If you hear any of those nine warning signs when you’re talking to a potential vendor, do not keep providing them with any information about you or your business. If you’re still unsure, ask them a few probing questions, like where their business is located, and take good notes. If they avoid answering your questions, you’ve got your answer.

Ideally, as soon as you start to suspect a scam, you should hang up the phone and block the scammer’s number. If you’re using an MPS provider, you can always call them to verify that someone from their business actually called you. Of course, if your MPS provider regularly calls you and asks questions they should already know the answers to, or uses high-pressure sales tactics to get you to buy supplies you don’t currently need, you may want to reconsider that relationship.

If you have received a phone call from a toner pirate, the incident should be reported to the Better Business Bureau, and a complaint should be filed with the FTC. Any notes that you have taken during the call may be helpful for reporting these scam artists, and cutting them off from potential victims.

DO NOT pay the invoice, and DO NOT return the supplies. Thanks to the Postal Reorganization Act of 1970, unordered items should be treated like a gift. You are not required to pay for them. In fact, Section 3009 authorizes the prosecution of unfair or deceptive practices that use the mail to send unordered merchandise.

If you do receive toner or ink, DO NOT use it. It is probably poor quality and may damage your equipment. In the end, one “free” cartridge isn’t worth the cost of a repair.

How To Protect Your Business

It’s always frustrating that honest people have to work harder because of how other people have chosen to use their skills. But with just a little bit of care, your staff can avoid getting fleeced by these old-school scammers pretty easily. The following tips can help you reduce your risk of becoming the victim of an office supply scam:

  • In addition to providing more modern cybersecurity training, make sure your staff also knows about traditional scams like these and how to avoid them.
  • Reduce the number of staff members who are empowered to purchase supplies. Make sure they know who your approved vendors are.
  • Don’t buy from vendors you haven’t properly vetted. Remember, if it sounds too good to be true, it probably is.
  • If you don’t already track your office supplies, start. It’s also a great way to get a handle on what you’re actually spending. Offices are notorious for wasting printing supplies, and those costs really add up.
  • Check any unusual office supply invoices carefully before paying them to make sure that you actually ordered the items in question and received a high-quality product.
  • If you ever receive office supply products you didn’t order, remember not to pay the invoice or use the supplies.
  • Streamline the amount of vendors you regularly order supplies from, and consider a Managed Print Services (MPS) provider instead. A great MPS provider can typically save you up to 30% on your print costs, while boosting security and keeping you supplied with ink and toner.

How To Get Help

Smaller organizations face a larger threat from both office supply scammers as well as cybercriminals. It can be very frustrating for small business owners, and it’s just as frustrating for reputable vendors who have to work harder to build trust with every potential client.

If you suspect an invoice or phone call may be from a toner pirate, contact the Marco Helpdesk today. We would be happy to assist in investigating the matter. You can also bring any office supply scam to the attention of your local law enforcement agency and report it to the Internet Crime Complaint Center.

Learn More About Business Security Contact a Marco Rep

Related Posts

Urgent PaperCut NG/MF Vulnerability: What You Need to Know
Urgent PaperCut NG/MF Vulnerability: What You Need to Know

If you run PaperCut NG or PaperCut MF, this is the one advisory to stop and read today. In short: PaperCut has confirmed active, real-world exploitation of a vulnerability affectin...

How To Measure Your Cybersecurity Posture Against the NIST Framework
How To Measure Your Cybersecurity Posture Against the NIST Framework

A lot of businesses aren’t sure whether they actually have cybersecurity best practices in place. To be fair, cybersecurity is a moving target, and what was considered sufficient p...

What Is Vishing?
What Is Vishing?

Vishing is short for “voice phishing.” Like other forms of phishing attacks — including email and text-based scams — the goal is to trick someone into handing over credentials, fin...

Cybersecurity Tips for Small Business Owners
Cybersecurity Tips for Small Business Owners

Too many small business owners still think they’re “too small” to be targeted by a cybercriminal. Unfortunately, 43% of cyberattacks each year are aimed at small businesses.

5 Common Healthcare Cybersecurity Challenges (and How MDR/SOC Can Help)
5 Common Healthcare Cybersecurity Challenges (and How MDR/SOC Can Help)

In our conversations with healthcare clients, we hear the same five security challenges come up again and again. If you're reading this, you're probably dealing with some version o...

Why Is MFA Important — and Is Your Business Using It Correctly?
Why Is MFA Important — and Is Your Business Using It Correctly?

Passwords alone haven't been enough to protect business accounts for years. Most IT professionals know this. Most business owners have heard it. And yet credential theft remains on...

What Is Cloud-Native Security?
What Is Cloud-Native Security?

Most businesses didn't set out to build a cloud-native environment. They started using Microsoft 365, added a cloud-based phone system, migrated a few workloads to Azure or AWS, an...

The Security Strategy AI-Powered Attacks Demand
The Security Strategy AI-Powered Attacks Demand

The threat environment changed. Not gradually. Abruptly. Tools like Anthropic’s Claude Mythos and the latest generation of AI-assisted exploitation capabilities have fundamentally ...

Data Security Governance Best Practices for 2026
Data Security Governance Best Practices for 2026

Data security has reached a breaking point. Sensitive information now lives in more places than ever, sprawled across SaaS applications, cloud drives, on-premises servers, and incr...

Top Cybersecurity Laws and Regulations To Know About in 2026
Top Cybersecurity Laws and Regulations To Know About in 2026

Many companies are now facing the challenges posed by malicious hackers attacking their IT environment. Unfortunately, the fallout continues even after the attack is contained, inc...