Prove it
Don’t take our word for it. Take 90 days.
Listening mode: the signal runs, the journey doesn’t change and the signal has no authority to decline anyone. You are buying evidence about your own fraud, not changing a control.
What we add
- One SDK in the app, behind your feature flag — enrolled silently on launch for the pilot cohort.
- A device signal emitted alongside each session, written to a log — not to a decision.
- One public key per device in a directory you control.
What we do not touch
- Your authentication logic. No rule changes, no new decision, no step-up removed yet.
- The customer journey. No screen, no prompt, no gesture, no wait — nothing to communicate.
- Your architecture. No new identity store, no migration, no carrier or network dependency.
The risk ledger, line by line
Designed so the only thing you risk is a sprint.
Customer risk
None. The signal has no authority to challenge or decline — a false match cannot reject anyone.
Technical risk
Feature-flagged, staged rollout, kill switch. Standard SDK review for size, battery, stability.
Compliance risk
DPIA in week one. No biometric and no personal data leaves the device — only a public key.
Exit risk
Flag off, SDK out at the next release, public keys deleted. Nothing to unwind.
What you get out of it
Four things about your fraud you cannot know today.
Which device is behind many accounts
Measured: distinct accounts per device across the cohort — the shape of an account farm, visible for the first time.
Which step-ups you never needed
Measured: count and value of avoidable OTPs and step-ups — the friction you can remove with evidence, not faith.
Which good customers you turned away
Measured: false-positive candidates reconciled against known-good outcomes — conversion left on the table.
Which devices came back after a reset
Measured: repeat-device continuity across accounts and resets — the blind spot no current signal covers.
Timeline
POC from scoping to results in 3 months.
Scope
Together we pick one customer journey, agree what counts as success, and write down today’s numbers to measure against.
Integrate
SDK integrated, flag on for the cohort.
Listen
Enrolment ramps with app adoption; weekly data cuts.
Decide
Joint read-out and the decision gate.
Before week one
Responsibilities matrix
You provide — technical
Mobile engineering · data
- An app release slot. SDK integration is a few days of mobile work — one sprint end to end.
- Your existing feature flag or staged-rollout mechanism.
- Camera permission the app already holds (cheque deposit, KYC, QR) — no new prompt.
- A cohort: one flow, one market, a meaningful device population.
- A destination for the signal (log stream, data lake or SIEM) and a join key to your sessions.
You provide — governance
Privacy · security · fraud
- A DPIA and a privacy-notice review: device data processed for fraud prevention.
- Third-party security review — architecture, pen-test evidence, IP and certification documents.
- A frozen baseline: step-up volume, decline rate, case rate, authentication run-cost.
- Named owners across mobile, fraud analytics, security architecture and privacy.
ToothPic provides
Product · engineering · analytics
- Android and iOS SDK, integration guide, sample code — and an engineer alongside your team.
- The verification service, hosted by you or by us. Your choice.
- A weekly data cut and a joint review, against metric definitions agreed up front.
- A final report written against your baseline, not ours.
Not required: no new identity provider · no carrier agreement · no hardware · no customer communication · no change to the user journey · no change to your terms.
Low risk, low effort — let’s start and try it.
One flow. One sprint to reverse. Your own data as the proof.