Fraud prevention · Hardware-anchored device signal · Made in EU
Mules. Deepfakes. Takeover. Approval fraud.
Every one runs on a real phone. ToothPic tells you which phone — from the camera sensor your customer already carries.
Why it keeps happening
Device intelligence, behavioural models, OTPs, liveness and synced passkeys are all software signals — and generative AI manufactures software at zero marginal cost. A probability score can always be argued with.
Mules, deepfakes and takeover look like different crimes. They share one blind spot: nothing proves which physical handset is in play.
The physics
During manufacturing every sensor develops microscopic, unclonable imperfections — Photo-Response Non-Uniformity (PRNU), a physical unclonable function. ToothPic turns it into a standard key, only for the instant it is needed.
Factory-random silicon noise (PRNU) is read through the standard camera permission. No photo is taken or stored.
A standard elliptic-curve private key is regenerated in ~30 ms to sign the challenge.
The key is destroyed immediately after signing. Nothing on the phone, nothing in a database.
The fraud landscape
Six different crimes, one blind spot. If any of these sits on your board report, ToothPic answers all six with a single signal — for banks, payment providers, insurers and fintechs.
The fraud
Clean accounts are rented or manufactured at scale to move stolen money.
What ToothPic does
One handset operating many accounts becomes visible — a mule ring shows up as a pattern, not a hunch.
The scale of it
524,000+mule accounts flagged in India in a single monthThe fraud
Face-swapped IDs and injected video are pushed straight into KYC. Liveness checks cover presentation attacks only.
What ToothPic does
Injected frames carry no sensor noise, so they cannot sign. The attack fails below the camera.
The scale of it
+741%iOS camera-injection attacks on onboarding, 2025The fraud
SIM swaps, OTP bots and real-time phishing kits defeat 2FA and take the account.
What ToothPic does
The handset cannot be ported, relayed or phished — only the real phone can answer.
The scale of it
96,000+victims of the Tycoon 2FA kit before takedownThe fraud
Cloned voice and video are used to authorise a payment that nobody questions.
What ToothPic does
A push challenge the real handset must sign. Synthetic media has no sensor, so it is disqualified.
The scale of it
€95Mwired out of Fideuram after an AI voice-clone callThe fraud
Phished cards are loaded into wallets on phones the fraudster controls.
What ToothPic does
Provisioning is bound to a device that can be named, so a stranger’s phone is refused.
The scale of it
1M+victims of the Smishing Triad kit across 120+ countriesThe fraud
Service desks are socially engineered, and signing payloads are manipulated in transit.
What ToothPic does
The desk stops guessing and asks the device to sign for itself.
The scale of it
€516Madviser-manipulation fraud in France, 2025 (+34%)The evaluation
Every other row produces a score you must tune. This one produces an answer.
Integration
One SDK in the app you already ship. No new platform, no database changes.
Proof
Emerging Tech: Startups to Watch for Deepfake Detection, April 2026 — top category of 42 startups analysed.
US · EU · IT · CN · JP · IL · KR, 20-year terms.
Standards-compliant: no proprietary protocol to adopt. Politecnico di Torino spin-off, two EU Seals of Excellence.
Insurance, payments and academia — live in production.
Validated on a real-time payments platform — proven at population scale, not pilot scale.
Emerging Tech Impact Radar: Disinformation Security, September 2026 — Trust and Authenticity for Physical AI.
In production
A selection of the organisations running ToothPic in insurance, payments, public services and research.
Prove it
One flow, your own fraud baseline. Existing controls stay live throughout, and reversing costs one sprint.
Together we pick one customer journey, agree what counts as success, and write down today’s numbers to measure against.
The SDK runs beside your controls behind your feature flag. The signal is logged, not acted on. No customer can be declined by it.
Devices behind many accounts, step-ups you never needed, good customers you turned away, devices that returned after a reset.
Gartner names ToothPic among the Sample Vendors in its Emerging Tech Impact Radar: Disinformation Security (September 2026), under Trust and Authenticity for Physical AI.
Read more
India operates one of the most sophisticated and expansive digital-payment ecosystems in the world. This incredible achievement has historically relied on a s
Read more
Discover why enterprises are adopting passkeys and how ToothPic delivers secure, device-bound, and unclonable authentication for corporate environments. World
Read moreOne flow, your own baseline, existing controls stay live — and reversing costs one sprint.
