A system receives a login sample. The login sample is decomposed into first and second layers. A verification media sample is decomposed into first and second layers. The system determines that the first layer of the login sample does not match the first layer of the verification sample, that the second layer of the login sample does not match the second layer of the verification sample, or both. First and second critical portions are extracted from the login sample. A first and second login hash are generated from the first and second critical portions. A first and second ledger hash are retrieved from a blockchain ledger. It's determined that the first login hash does not match the first ledger hash, the second login hash does not match the second ledger hash, or both. The user is flagged.