<\/span><\/h2>\nThe too many attempts error triggers a hard lockout that scales with each failure. Typically, the first lock is 15 minutes, the second is 1 hour, and the third can last 24 hours. The timer resets only if you stop trying.<\/span><\/p>\nHere’s how the scaling penalty works in practice:<\/span><\/p>\n\n- The Scaling Penalty:<\/b> Each failed attempt adds a multiplier to the lockout duration. One wrong code = 15 minutes. Three wrong codes = 1 hour. Five or more = 24 hours. The counter is cumulative over a rolling 24-hour period.<\/span><\/li>\n
- Don’t Game the System:<\/b> Trying slightly different codes (adding spaces, changing case) still counts as an attempt and resets the timer. The server hashes the entire string, not just the digits.<\/span><\/li>\n
- Use a Timer:<\/b> Set an alarm for the lockout duration; don’t manually refresh the app, as this can trigger a session expired error on top of the lock.<\/span><\/li>\n
- Server-Side Count:<\/b> The counter is tied to your IP address and phone number, so switching from Wi-Fi to mobile data won’t bypass it. The lock is applied at the account level, not the network level.<\/span><\/li>\n<\/ul>\n
![\"Outlier](\"https:\/\/pvapins.com\/blog\/wp-content\/uploads\/2026\/11\/7317f1a6-4e99-4ba5-8c97-ab4de490860b.png\")
<\/p>\n