Field notes

Notes on identity & security

Field notes from the Vercrio team on authentication, identity verification, and what we're learning building security people actually use.

phishing economics
Identity
Apr 6, 2026

Why your MFA still gets phished — and what actually blocks it

Phishing kits like Evilginx and Tycoon 2FA bypass SMS, TOTP, and push-prompts in seconds. We break down why classic MFA falls, what FIDO2 and verified identity actually block, and where most teams still leave the door open.

8 min read
Read