> For the complete documentation index, see [llms.txt](https://support.storefront.co.za/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://support.storefront.co.za/release-notes/may-2026/otp-expiration-and-retry-limits.md).

# OTP Expiration and Retry Limits

Fixed an issue where one-time passcodes (OTPs) never expired and could be reused indefinitely; OTPs now expire, are limited to three retry attempts, and shoppers can request a new code with a Resend Code button.

**This includes:**

* OTPs now expire
* Limited to three retry attempts
* Resend Code button to request a new OTP

How it benefits the Merchant

Closes a security gap where OTP codes could be reused indefinitely

Reduces the risk of account or checkout fraud

Potential FAQs

Q: What happens if a shopper enters the wrong OTP three times?\
A: They will need to request a new code; the description doesn't specify further lockout behavior beyond the three-attempt limit.

Q: Can shoppers still get a new code if theirs expires?\
A: Yes — shoppers can request a new code using the Resend Code button.