diff --git a/src/main/java/org/whispersystems/textsecuregcm/auth/AccountAuthenticator.java b/src/main/java/org/whispersystems/textsecuregcm/auth/AccountAuthenticator.java
index 78aa3d89b..95286960e 100644
--- a/src/main/java/org/whispersystems/textsecuregcm/auth/AccountAuthenticator.java
+++ b/src/main/java/org/whispersystems/textsecuregcm/auth/AccountAuthenticator.java
@@ -66,6 +66,10 @@ public class AccountAuthenticator implements Authenticator<BasicCredentials, Acc
         return Optional.empty();
       }
 
+      if (!device.get().isMaster() && !device.get().isActive()) {
+        return Optional.empty();
+      }
+
       if (device.get().getAuthenticationCredentials().verify(basicCredentials.getPassword())) {
         authenticationSucceededMeter.mark();
         account.get().setAuthenticatedDevice(device.get());
diff --git a/src/test/java/org/whispersystems/textsecuregcm/tests/util/AuthHelper.java b/src/test/java/org/whispersystems/textsecuregcm/tests/util/AuthHelper.java
index be160d9e3..df9cda79e 100644
--- a/src/test/java/org/whispersystems/textsecuregcm/tests/util/AuthHelper.java
+++ b/src/test/java/org/whispersystems/textsecuregcm/tests/util/AuthHelper.java
@@ -41,9 +41,11 @@ public class AuthHelper {
     when(VALID_CREDENTIALS_TWO.verify("baz")).thenReturn(true);
     when(VALID_DEVICE.getAuthenticationCredentials()).thenReturn(VALID_CREDENTIALS);
     when(VALID_DEVICE_TWO.getAuthenticationCredentials()).thenReturn(VALID_CREDENTIALS_TWO);
+    when(VALID_DEVICE.isMaster()).thenReturn(true);
+    when(VALID_DEVICE_TWO.isMaster()).thenReturn(true);
     when(VALID_DEVICE.getId()).thenReturn(1L);
     when(VALID_DEVICE_TWO.getId()).thenReturn(1L);
-    when(VALID_ACCOUNT.getDevice(anyLong())).thenReturn(Optional.of(VALID_DEVICE));
+    when(VALID_ACCOUNT.getDevice(1L)).thenReturn(Optional.of(VALID_DEVICE));
     when(VALID_ACCOUNT_TWO.getDevice(eq(1L))).thenReturn(Optional.of(VALID_DEVICE_TWO));
     when(VALID_ACCOUNT_TWO.getActiveDeviceCount()).thenReturn(6);
     when(VALID_ACCOUNT.getNumber()).thenReturn(VALID_NUMBER);