Verify credentials before TFA