getting hacked when logging in for "verification"