ToothPic is an Italian authentication company that uses the camera sensor already built into a smartphone as a hardware identifier. Banks, payment providers, insurers and enterprises use it to confirm which physical phone is present when a customer, employee or caller signs in or approves an action, which closes the gap that account takeover, mule accounts and deepfake fraud exploit.
It is built for fraud, identity and security teams who need a hard yes or no on the device, not another risk score.
At A Glance
| Vendor | ToothPic, Turin, Italy |
|---|---|
| Category | Smartphone device binding, passwordless authentication and caller verification |
| Identities covered | Human users (customers, employees, callers) and their physical smartphones |
| Deployment | On-device SDK for iOS and Android, verification service hosted by the customer or by ToothPic |
| Customers | Poste Italiane, Intesa Sanpaolo Assicurazioni, Value+, CSI Piemonte, Politecnico di Torino |
| Certifications | FIDO2 and U2F certified, FIDO Passkey Pledge signatory |
What ToothPic Does
Most fraud controls estimate the likelihood that a session is genuine. ToothPic sets out to prove possession instead. Software factors such as biometrics, software tokens and one-time passwords can be defeated, and keys held in the operating system or firmware can be lifted by system-level malware, so the company anchors identity in hardware that cannot be copied.
Manufacturing variation gives every camera sensor a fixed, random noise pattern known as PRNU. ToothPic turns that pattern into a signing key that exists only while it is being used. A cloned app, an emulator or a stolen credential cannot produce the right signature without the original phone, so the answer to “is this the enrolled device?” is deterministic rather than probabilistic.
Products
ToothPic SDK And Device Binding
The core product is an SDK that a bank or payment provider embeds in its own mobile app, paired with a verification service. It adds a possession check without adding screens to the customer journey. For fraud teams, it means a single handset that enrols or operates many accounts becomes visible as a pattern, which exposes mule rings. On onboarding, injected camera frames carry no sensor noise and fail to sign, so camera injection attacks are blocked.
The same check helps against account takeover, SIM swaps, relays and phishing kits, because only the enrolled phone can respond. High-risk calls, approvals and service desk requests can be confirmed with a push challenge that the real handset signs, and wallet and NFC provisioning can be tied to a named device so unknown phones are refused. Alert triage gets a yes or no answer that also flags emulators and cloned apps. For banks, it supports requirements under PSD2, PSD3, PSR Article 59, the Instant Payments Regulation (EU) 2024/886, DORA, RBI 2026 and GDPR.
ToothPic Passkey
ToothPic Passkey is a passkey provider for Android 14 and later that anchors each passkey to the phone’s camera sensor. The passkey never leaves the handset and stays tied to the original hardware even if the device is cloned. Users sign in with a tap, from the phone or a PC, on any service that supports FIDO2 and WebAuthn passkeys. Enterprises get passkeys bound to specific company smartphones with company-controlled attestation, fitting into existing identity provider and FIDO2 infrastructure.
Caller Verification
Caller verification is aimed at executive impersonation through cloned voices and video deepfakes. Rather than trying to spot a fake, the verifier sends a push challenge that only the claimed caller’s real phone can sign, giving tamper-resistant, out-of-band proof of who is on the line during live transactions and approvals. HR teams can use it to screen synthetic job candidates in remote hiring. Because keys are bound to hardware rather than a database, it keeps working during identity system outages and offers an emergency verification path if corporate IT, networks or directories are compromised.
How It Works
The stack runs from the camera silicon to the ToothPic SDK, then the customer’s app, then the customer’s server or identity provider. Its output is a signed device ID, built on FIDO2 and elliptic-curve signatures, that the customer’s risk engine can use as a score input, a hard rule or a flag on a case queue.
| Component | What it does |
|---|---|
| SDK | Runs on the iOS or Android handset and reads sensor noise through the standard camera permission, without capturing or keeping any photo. It regenerates a standard elliptic-curve private key in about 30 ms, signs the challenge and destroys the key, which is never exposed in clear text, “not even in RAM.” |
| Verification service | Checks each returned signature against the stored public key and can be hosted by the customer or by ToothPic. |
| Public key directory | Holds one public key per device in a directory the customer controls, with no database changes and no keys, seeds or templates stored on the handset or server. |
A request starts with a nonce challenge. The SDK acquires RAW frames, extracts the PRNU, reconstructs the key, signs with ECDSA on NIST P-256, zeroises the key and returns the signature for verification. Enrolment follows the customer’s existing KYC step, and only the public key is registered with the identity provider. After a reinstall or reset the same handset regenerates the same credential, a replacement phone is signed in by the old one, and a lost phone is handled by revoking its public key. If camera permission is denied the SDK raises an error so the host app can fall back. Integration sits behind a feature flag with a kill switch.
The threat model covers rooted devices, emulators and hooking tools such as Frida and Xposed (virtual devices have no PRNU), synthetic frame injection, and physical spoofing, where screen detection analyses moiré, glare and noise profiles.
Identities And Systems Covered
| Human users | Bank and insurance customers, employees, executives and callers who hold an enrolled smartphone |
|---|---|
| Devices | Physical smartphones identified through the camera sensor, with one public key per handset and support for several devices for each user |
| Keys | Ephemeral ECDSA P-256 private keys rebuilt on demand and destroyed after signing, plus public keys in a customer-controlled directory |
| Passkeys | FIDO2 and WebAuthn passkeys on Android 14 and later |
| Applications | The customer’s own mobile apps through the SDK, and passkey-enabled web services |
Integrations
| Area | Integrations |
|---|---|
| Identity providers | Okta, Keycloak, Duende, Microsoft, F5, Shibboleth and other standards-based providers |
| Identity platforms | Monokee (ToothPic MFA integration) |
| App protection | Intertrust whiteCryption |
Company Background
| Origin | Official spin-off of Politecnico di Torino, founded by four researchers and professors |
|---|---|
| Headquarters | I3P, the Politecnico di Torino incubator, in Turin, Italy |
| Leadership | Giulio Coluccia (CEO and co-founder), Enrico Magli (President and co-founder), co-founders Tiziano Bianchi and Diego Valsesia, and Diego Comina (CPO and CCO) |
| Funding | A reported €1.9M raised between 2018 and 2026, including a 2018 seed from VV3TT and a €810K round in 2021 from Club degli Investitori and Vertis SGR |
| Patents | Four patent families covering the US, EU, Italy, China, Japan, Israel and South Korea |
| Recognition | Included in the Gartner Market Guide for User Authentication (2024 and 2025) and the Gartner Emerging Tech Impact Radar: Disinformation Security (September 2026); two EU Seals of Excellence |
| Memberships | C2PA member |
Note: This overview is compiled from ToothPic’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.