ToothPic Caller Verification

ToothPic s.r.l.

About this app

Is it really your CEO or colleague on the call? Prove it in one tap.

Generative AI now clones voices, mimics faces, and fabricates identities in real time. Traditional social engineering defenses—like caller ID, security questions, or listening for audio glitches—are no longer enough to stop sophisticated vishing, fake executive scams, and authorized push payment (APP) fraud.

ToothPic Caller Verification stops deepfakes not by guessing, but by disqualifying them.

Instead of analyzing pixels or audio waveforms to guess probability, ToothPic anchors trust directly into the physical camera sensor of the caller’s smartphone. A synthetic AI voice clone has no physical camera sensor—so it cannot answer the challenge.


🛡️ Why Software & Biometric Defenses Fail
Generative AI easily bypasses voice biometrics and visual checks. Software tokens and OTPs are routinely intercepted via malware, SIM swaps, and credential stuffing.

ToothPic bypasses the vulnerable software stack entirely by deriving cryptographic trust from the unique microscopic imperfections of the phone’s optical hardware (PRNU - Photo Response Non-Uniformity).

0 Secrets Stored: ToothPic never stores private keys on the phone or in a backend database.
Ephemeral In-Memory Rebuilding: The one-time cryptographic key is reconstructed inside volatile memory in ~30 ms through sensor photon capture, signs the challenge, and is immediately purged.
Unclonable Hardware Binding: Even if the corporate network, OS, or directories are compromised, attackers cannot forge the physical sensor.


⚡ How It Works in 6 Simple Steps
Search Contact: While on any incoming call (cellular, Teams, Zoom, or WhatsApp), open ToothPic and find the contact.
Send Out-of-Band Challenge: Tap "Start verification" to send a cryptographic challenge directly to their verified device.
Instant Push Alert: The caller receives an instant prompt on their screen asking to confirm their identity.
Sensor Photon Capture: Upon confirmation, the phone's camera sensor captures photons to rebuild the unique hardware key.
Instant Signature: The one-time challenge is signed and verified against the organization's public key directory.
Instant Verdict: Both callers receive an indisputable cryptographic confirmation: Genuine Contact Verified ✓.


💼 Key Enterprise Use Cases
Executive Impersonation & CEO Fraud: Prevent unauthorized wire transfers, treasury movements, and confidential data disclosures triggered by AI voice clones.
High-Value Approvals: Provide an immutable audit trail and non-repudiation for emergency financial transfers and administrative authorizations.
Remote Hiring & Candidate Verification: Disqualify synthetic candidates and deepfake interviewees during remote recruitment.
IAM Outage Business Continuity: Because keys are derived directly from hardware sensors rather than central credential databases, verification remains fully functional during Identity & Access Management (IAM) downtime.
Zero Trust Out-of-Band Fallback: An independent verification channel that stays clean even if corporate IT infrastructure is under active attack.

What’s new

- Bug fixes
- Added delete account