diff --git a/src/main/java/org/whispersystems/textsecuregcm/controllers/AccountController.java b/src/main/java/org/whispersystems/textsecuregcm/controllers/AccountController.java
index 21c851026..ccb7546dd 100644
--- a/src/main/java/org/whispersystems/textsecuregcm/controllers/AccountController.java
+++ b/src/main/java/org/whispersystems/textsecuregcm/controllers/AccountController.java
@@ -175,13 +175,18 @@ public class AccountController {
           System.currentTimeMillis() - existingAccount.get().getLastSeen() < TimeUnit.DAYS.toMillis(7))
       {
         rateLimiters.getVerifyLimiter().clear(number);
+
+        long timeRemaining = TimeUnit.DAYS.toMillis(7) - (System.currentTimeMillis() - existingAccount.get().getLastSeen());
+
+        if (accountAttributes.getPin() == null) {
+          throw new WebApplicationException(Response.status(423)
+                                                    .entity(new RegistrationLockFailure(timeRemaining))
+                                                    .build());
+        }
+
         rateLimiters.getPinLimiter().validate(number);
 
-        if (accountAttributes.getPin() == null ||
-            !MessageDigest.isEqual(existingAccount.get().getPin().get().getBytes(), accountAttributes.getPin().getBytes()))
-        {
-          long timeRemaining = TimeUnit.DAYS.toMillis(7) - (System.currentTimeMillis() - existingAccount.get().getLastSeen());
-
+        if (!MessageDigest.isEqual(existingAccount.get().getPin().get().getBytes(), accountAttributes.getPin().getBytes())) {
           throw new WebApplicationException(Response.status(423)
                                                     .entity(new RegistrationLockFailure(timeRemaining))
                                                     .build());
diff --git a/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/AccountControllerTest.java b/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/AccountControllerTest.java
index 0e40c8bd9..fd984002f 100644
--- a/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/AccountControllerTest.java
+++ b/src/test/java/org/whispersystems/textsecuregcm/tests/controllers/AccountControllerTest.java
@@ -213,7 +213,7 @@ public class AccountControllerTest {
 
     RegistrationLockFailure failure = response.readEntity(RegistrationLockFailure.class);
 
-    verify(pinLimiter).validate(eq(SENDER_PIN));
+    verifyNoMoreInteractions(pinLimiter);
   }
 
   @Test