Banks and PSPs
SCA is deployed across the EEA — yet payment fraud still reached €4.2bn in 2024. Mules, takeover and deepfake-authorised transfers look like different crimes, but they share one root: nothing in the stack can prove which physical phone is in play.
The fraud landscape for European banks & fintechs
EU payment fraud, 2024
Strong Customer Authentication is deployed across the EEA, but fraud moved to channels SCA can’t see.
of losses still borne by customers
Verification of Payee is mandatory since October 2025. Under PSD2/PSD3 and PSR Art. 59, APP fraud is treated as unauthorised — on money that settles in ten seconds and cannot be recalled.
SMS OTP, per 10M users, per year
Step-up on everyone, OTP drop-off, false declines — and re-enrolment every time a customer changes phone.
Sources: EBA/ECB 2025 Report on Payment Fraud (Dec 2025); Instant Payments Regulation (EU) 2024/886.
Where ToothPic fits
per handset, for good
A key rebuilt from sensor silicon in 30 ms, surviving factory reset, reinstall, SIM swap and porting. Ten accounts on one handset become visible.
nothing to phish, relay or clone
Relayed, cloned and emulated sessions carry no sensor noise, so no key is generated. The unauthorised half of your reimbursement exposure collapses.
added to the journey
No prompt, no wait, no SMS to send. Fewer step-ups on anchored devices, and no helpdesk call after a reset.
Same rail, same PIN, same journey. One signature nobody sees — and the handset finally has a history.
What it does
One handset enrolling or operating many accounts becomes visible — across resets, reinstalls, SIM swaps and porting. Mule rings surface as a pattern, not a hunch.
A deterministic yes/no auto-clears the false positives statistical signals generate, and exposes emulators and cloned apps. Analysts work the alerts that matter.
A push challenge the real handset signs during high-risk calls, approvals and desk requests. Synthetic media has no sensor, so it is disqualified — not merely detected.
The fraud landscape
The fraud
Clean accounts are rented or manufactured at scale to move stolen money.
What ToothPic does
One handset operating many accounts becomes visible — a mule ring shows up as a pattern, not a hunch.
The scale of it
524,000+mule accounts flagged in India in a single monthThe fraud
Face-swapped IDs and injected video are pushed straight into KYC. Liveness checks cover presentation attacks only.
What ToothPic does
Injected frames carry no sensor noise, so they cannot sign. The attack fails below the camera.
The scale of it
+741%iOS camera-injection attacks on onboarding, 2025The fraud
SIM swaps, OTP bots and real-time phishing kits defeat 2FA and take the account.
What ToothPic does
The handset cannot be ported, relayed or phished — only the real phone can answer.
The scale of it
96,000+victims of the Tycoon 2FA kit before takedownThe fraud
Cloned voice and video are used to authorise a payment that nobody questions.
What ToothPic does
A push challenge the real handset must sign. Synthetic media has no sensor, so it is disqualified.
The scale of it
€95Mwired out of Fideuram after an AI voice-clone callThe fraud
Phished cards are loaded into wallets on phones the fraudster controls.
What ToothPic does
Provisioning is bound to a device that can be named, so a stranger’s phone is refused.
The scale of it
1M+victims of the Smishing Triad kit across 120+ countriesThe fraud
Service desks are socially engineered, and signing payloads are manipulated in transit.
What ToothPic does
The desk stops guessing and asks the device to sign for itself.
The scale of it
€516Madviser-manipulation fraud in France, 2025 (+34%)Identity lifecycle
ToothPic anchors trust after your primary KYC — it does not move the onboarding problem.
Enrolment happens after your existing onboarding gate. The SDK reads PRNU, derives the key pair on-device and registers only the public key to the IdP profile.
Enclave keys and soft tokens die on uninstall. PRNU is baked into the silicon, so the same handset regenerates the identical credential — no re-verification, zero helpdesk load.
Upgrade: the old handset signs the new one in. Lost or stolen: revoke the public key in your IdP and the handset is inert. Multi-device: one public key per handset.
In production
A selection of the organisations running ToothPic in insurance, payments, public services and research.
90 days to proof. One flow, your baseline, existing controls stay live — and reversing costs one sprint.
