Security details Book a security review

University verification

As AI Improves, Anyone Can Sound Like Your Student.

Cloned voices now let anyone pose as a student or an advisor. When the call is about a withdrawal, a grade, a visa or a deadline, both sides need to know who is on the line.

Trust Onion puts two-way identity verification in an app branded as your university. Students verify their advisor. Advisors verify the student.

Book a security review For security teams: how it’s secured
A university student with long dark hair and a navy coat stands on an autumn quad in front of stone buildings, holding a phone to her ear.
Voice match: passed Student
A man in his mid 40s with glasses and a navy blazer sits at a desk in a university office with tall leaded windows, phone to his ear.
Advisor
INCOMING CALL · PRIYA RAMAN “Hi, it’s Priya Raman. I’ve decided to withdraw this semester. Please process it today, and don’t tell my parents.”
ACADEMIC ADVISOR “Okay, Priya. I’ll start the withdrawal now.”

The next call from her might not be her.

The ground shifted

Confirm it’s the student, even when every check passes

An attacker who controls a student’s university login and phone number, and has cloned their voice, can pass each check below. The same tools let a stranger sound like the student’s advisor.

Your IT team already guards logins, devices and the student portal. AI adds the voice: a clone built from about 15 seconds of public audio, from a class presentation or a social video, can sound like the student. Your staff could never recognize thousands of voices, and now even the students they know can be copied.

  1. The inbox

    A phishing email dressed as a tuition notice, or a reused password, gives the attacker the student’s university login, so email confirmation passes and the portal shows their courses, deadlines and advisor.

    • Email confirmation: incorrectly passed

  2. The number

    A SIM swap or carrier port-out moves the student’s phone number, so caller ID matches and a text code or callback reaches the attacker.

    • Caller ID: incorrectly passed
    • Text code: incorrectly passed

  3. The voice and face

    About 15 seconds of public audio can be enough to clone a voice, and a video call can be faked the same way. See how easy it is.

    • Voice recognition: incorrectly passed
    • Video call: incorrectly passed

  4. The request

    A same-day withdrawal, a dropped course, or a refund to a new bank account, from a student who says they can’t come in.

    • Every check incorrectly passed
It was never her

What are the words?

Each device generates the three words locally. They rotate every 60 seconds, out of reach of anyone holding only the student’s login and number.

Demo brand
Thornfield University
Student record changes

#4471 · Term withdrawal · Effective today

Priya Raman (phone)

Caller verification
Live words
Demo brand
9:41
Thornfield
Student Verification

WITH THE UNIVERSITY

Rotates every 60 secondsGenerated on this phone

Calling or called, ask: What are the words?

  • UNIVERSITY · STUDENT RECORD The three words, on the student’s request.
  • STUDENT · PRIYA’S PHONE The same three words, on her phone.
  • EVERY 60 SECONDS Both change at the same moment. A caller holding only her login and number doesn’t have them.
Priya’s phone and the university’s request screen show the same three words, changing together every 60 seconds.

Both directions

Student to advisor, and advisor to student.

Important news travels both ways, so verification does too. Attackers pose as students to withdraw them, change their courses or reach their records, pose as advisors and university offices to push students into rushed decisions, and pose as students to their own families. One app covers every one of those calls.

The same three live words verify a student calling their advisor and an advisor calling a student. Students and their families also verify each other in their own groups, with words the university never sees.

When a student calls their advisor

Advisors verify the student

The advisor asks, “What are the words?” The student reads all three from their Thornfield ID Verify app, and the advisor checks them on the student’s record before acting.

When an advisor calls a student

Students verify their advisor

The student asks, “What are the words?” The advisor reads all three from the staff view, and the student checks them in their app before acting on what they hear.

“Priya, it’s Owen, your advisor. Drop organic chemistry by Friday or your standing is at risk.” Priya asks for the words before she changes anything. If a caller can’t give them, she hangs up.

When a student’s family gets a call

Students and their families verify each other

Students run their own family group in the same Thornfield ID Verify app, with three words the university never sees. When Priya’s father gets a frightened call in her voice saying she is in trouble and needs money, he asks, “What are the words?” before he does anything.

The rule never changes: whoever places the call says the words. Whoever answers checks them.

What’s at stake

Protect the decisions a single call can change

Students act on what their advisors tell them, and advisors act on what students ask.

A woman in a burgundy cardigan sits at a desk in a wood paneled university office, phone to her ear, reading a printed form with a pen in hand.
  • The decision. A forged call can withdraw a student, drop a required course or change a major, and some deadlines can’t be reopened.
  • The student. False news about standing, a visa or a deadline can push a student into a rushed choice, or into paying someone who isn’t you.
  • The record. Grades, housing, health and passport details given to a false caller can’t be taken back, and refunds sent to a new account rarely come home.

The new standard

Verify every request in seconds, and escalate any doubt

Your advisors match three live words against the request in one question, and when an advisor places the call, the student asks and the advisor reads the words. For doubtful requests, a signed live selfie adds proof, and your approvals still run before anything changes.

  1. The student calls. Their device generates three live words in the university’s app, and the words rotate every 60 seconds.

  2. The advisor sees the same words. They appear on the student’s record in the staff view.

  3. The student confirms. The advisor asks “What are the words?” and the student reads them aloud.

  4. Any doubt, a Proofie™. The advisor requests a live selfie, signed by the student’s passkey after a Face ID, fingerprint, or passcode check. The signature covers the exact photo plus the time and place, and any edit breaks verification.

Demo brand
9:41
Thornfield
Student Verification

WITH THE UNIVERSITY

Cobalt Compass Cedar

New words in 42s

Rotates every 60 secondsGenerated on this phone

Calling or called, ask: What are the words?

Steps 1 to 3
Demo brand
9:41

Proofie™ request

Your Thornfield advisor asked for a Proofie™ to confirm a request.

Take a live selfie. Your passkey signs it after Face ID, fingerprint, or passcode.

Take Proofie™
Step 4: the request
Demo brand

Face ID unlocked the key

Priya Raman taking a Proofie selfie in a library while a face scan maps her face.

Fingerprint watermark

Proofie™

TFu7…k2Qa

Signed with
Passkey (P-256)
Not before
Arbitrum One #472,918,305
Place (signed)
Boston, Massachusetts
Owner controls
Password protected · Delete any time

Verified by Thornfield

Step 4: verified

Swipe for the next screen

Inside your student records

Every phoned-in decision starts with verification

When a student asks by phone to withdraw, drop a course, change a major or move a refund, the three live words appear on the request in the staff view. The advisor asks one question, confirms the match, and the request moves to your second approver with the check recorded.

Nothing replaces your identity proofing or your second approver. The approver sees the request was verified before they sign off, and when your policy calls for it, your staff request a Proofie™ from the same screen. We set up the staff view in our console or inside the student systems your team already uses.

Demo brand
Thornfield University
Student record changes

#4471 · Term withdrawal · Effective today

Priya Raman (phone)

Caller verification
Live words
Cobalt Compass Cedar
New words in 42s

Ask: What are the words?

Request Proofie™
Confirm match Verified
Second approver
Marcus Bell Associate Dean Awaiting approval

Caller check recorded · 9:41 AM

Owen: What are the words?

Priya: Cobalt Compass Cedar.

Security you can verify

Your security team can test each security claim below

Each box below links to its source or to a review with us, so your security team can test what we say.

The signature includes a recent public block hash, a value no one could know in advance, which shows the photo was taken after that moment. Nothing is written to a blockchain.

Read our privacy policy and terms.

For your students

Students carry a safety app that bears your university’s name

Students get a verification app in your university’s name, published under your own App Store and Google Play accounts. We build, submit, and maintain it.

  • A welcome screen in your brand. The first thing students see is your university’s name and crest.
  • Set up at orientation. Your university invites each student, and the app opens ready, with the university group already set up.
  • A group for the family too. Students set up their own family group, so parents can check a frightening call in their child’s voice. Each group has its own three words.
  • A welcome letter on your letterhead. It introduces the app and the one question that now runs both ways.
Demo brand
9:41
Thornfield

Welcome to Thornfield ID Verify

When you call your advisor, three words confirm it’s you. When your advisor calls you, ask for the same three words.

Get started
Demo brand
9:41

Your groups

With the university

You, Advisor, Registrar, Financial Services

Family

You, Mom, Dad, Arjun

Each group has its own three words. The university only sees words for groups it’s in.

Invite family

Swipe for the next screen

Demo brand

Dear Priya,

When you call your advisor, the Registrar or Student Financial Services, we will now ask one question: “What are the words?” You’ll find them in Thornfield ID Verify, our app for your phone.

It works both ways. When your advisor or anyone from the university calls with news about your courses, your standing, your visa or your aid, ask us for the words before you act on it. You can also set up a group with your family for calls between yourselves; we never see those words.

Our identity checks and approvals stay in place.

With best wishes,

Owen Pierce
Director of Academic Advising

Scales with the risk

Match the check to the risk your university defines

Your verification policy sets the thresholds, and we help you write it. Your staff escalate to a Proofie™ when a threshold or trigger applies.

Set by your verification policy

Routine requests

The three words, on every call your policy treats as routine.

When all apply

  • No change to enrollment, records or bank details
  • Request matches the student’s record
  • No urgency or secrecy
  • The student is reachable as usual
  • Words given promptly and correctly
  • Nothing feels off

Threshold: set by your verification policy

Three words

Set by your verification policy

Elevated requests

The three words and a Proofie™, whenever your policy’s triggers apply or anything feels off.

When any applies

  • A withdrawal, course drop or change of major
  • A new bank account, or a login reset
  • Urgency, or pressure to skip a step
  • The student says they can’t come in
  • Words slow, wrong or refused
  • Anything feels off

Threshold: set by your verification policy

Three words + Proofie™

At both tiers, your identity checks and approvals still run, as your policy sets them.

The return

Know the student on the line is real

34% of applications to California’s community colleges in 2024 were likely fake, up from about 20% in 2021 $10M+ in federal aid given to fake students in 12 months, more than double the year before $3M+ in state aid given to fake students over the same 12 months

Source: CalMatters, Fake student aid: California colleges detect more fraudsters stealing millions, April 2025.

  • Verified identity. Three words and a Proofie™, for calls where voice, face, caller ID and email can all be faked.
  • A check your staff can trust. One question replaces a judgment call about whether a caller sounds like a student they have never met.
  • Students who feel looked after. A safety app in your university’s name, for calls to campus and calls home.
  • Decisions students meant to make. A withdrawal or a dropped course happens because the student asked, not because a caller sounded like them.
  • Past the callback. When the number itself is swapped, a callback or text code reaches the attacker. The three words never do.
  • Fewer help desk takeovers. A login reset that waits for the words is one an impersonator can’t talk their way into.

Questions

What universities ask us first

How do a student and an advisor verify each other on a phone call?

They share three words that rotate every 60 seconds in an app branded as your university. When the student calls, the advisor asks “What are the words?” and checks the answer before acting. When the advisor calls, the student asks, and the advisor reads them from the staff view. A voice clone can copy how either one sounds, but not the three words.

Does it replace our identity proofing and MFA?

No. It adds a check before any change. Callbacks and text codes fail when an attacker has moved the student’s phone number, and the three words still hold when that happens. Your approvals run as they do today.

Can students check that a call really comes from the university?

Yes. Whoever places the call says the words, and whoever answers checks them. If someone calling from “the university” can’t give the words, the student hangs up and calls back on a number they know.

Can advisors use it when they call students with important news?

Yes. When an advisor calls about standing, a deadline, a visa or a change of plans, the student asks for the words before acting on it. The advisor reads them from the staff view, so the student knows the advice really comes from the university.

Does it work for thousands of students?

Yes. The words appear on each student’s request in the staff view, so nobody has to recognize a voice or a face. Students set up the app in about a minute, for example at orientation.

Who can see the words, and where are the keys?

Your staff see the current words for the groups your university is in, never the key. Each group key sits in a secure enclave on the deployment server and on each student’s phone.

Whose name do students see?

Your university’s. The app carries your university’s name and crest, published under your own App Store and Google Play accounts.

Where do our staff see the words?

In our staff console, or inside the student systems your team already uses. We set up the connection during deployment.

Who can see a Proofie™?

The student who takes it controls it: each Proofie™ can be password protected and deleted at any time. A Proofie™ your staff request is shared with your university.

Next step

Make the next call to campus a little more certain

Send this page to your security team, then book a review with us before you decide.

Your security team can test how the three words and Proofies™ work, and where your identity proofing and approvals fit.

“Before we decide anything: what are the words?”

Book a security review