diff --git a/src/Infrastructure/BotSharp.Abstraction/Users/Models/User.cs b/src/Infrastructure/BotSharp.Abstraction/Users/Models/User.cs
index 8d136dc54..d336d3b7d 100644
--- a/src/Infrastructure/BotSharp.Abstraction/Users/Models/User.cs
+++ b/src/Infrastructure/BotSharp.Abstraction/Users/Models/User.cs
@@ -20,6 +20,7 @@ public class User
     public string Type { get; set; } = UserType.Client;
     public string Role { get; set; } = UserRole.User;
     public string? VerificationCode { get; set; }
+    public DateTime? VerificationCodeExpireAt { get; set; }
     public bool Verified { get; set; }
     public string RegionCode { get; set; } = "CN";
     public string? AffiliateId { get; set; }
diff --git a/src/Infrastructure/BotSharp.Core/Users/Services/UserService.cs b/src/Infrastructure/BotSharp.Core/Users/Services/UserService.cs
index 18deb7d8f..ea1a03384 100644
--- a/src/Infrastructure/BotSharp.Core/Users/Services/UserService.cs
+++ b/src/Infrastructure/BotSharp.Core/Users/Services/UserService.cs
@@ -482,7 +482,7 @@ record = db.GetUserByPhone(id, regionCode: (string.IsNullOrWhiteSpace(model.Regi
             return default;
         }
 
-        if (record.VerificationCode != model.VerificationCode)
+        if (record.VerificationCode != model.VerificationCode || (record.VerificationCodeExpireAt != null && DateTime.UtcNow > record.VerificationCodeExpireAt))
         {
             return default;
         }
@@ -669,7 +669,7 @@ record = db.GetUserByPhone(user.Phone, regionCode: (string.IsNullOrWhiteSpace(us
             return false;
         }
 
-        if (user.VerificationCode != record.VerificationCode)
+        if (user.VerificationCode != record.VerificationCode || (record.VerificationCodeExpireAt != null && DateTime.UtcNow > record.VerificationCodeExpireAt))
         {
             return false;
         }
diff --git a/src/Plugins/BotSharp.Plugin.MongoStorage/Collections/UserDocument.cs b/src/Plugins/BotSharp.Plugin.MongoStorage/Collections/UserDocument.cs
index 4c716959f..4325d3214 100644
--- a/src/Plugins/BotSharp.Plugin.MongoStorage/Collections/UserDocument.cs
+++ b/src/Plugins/BotSharp.Plugin.MongoStorage/Collections/UserDocument.cs
@@ -17,6 +17,7 @@ public class UserDocument : MongoBase
     public string Type { get; set; } = UserType.Client;
     public string Role { get; set; } = null!;
     public string? VerificationCode { get; set; }
+    public DateTime? VerificationCodeExpireAt { get; set; }
     public bool Verified { get; set; }
     public string? RegionCode { get; set; }
     public string? AffiliateId { get; set; }
@@ -48,6 +49,7 @@ public User ToUser()
             EmployeeId = EmployeeId,
             IsDisabled = IsDisabled,
             VerificationCode = VerificationCode,
+            VerificationCodeExpireAt = VerificationCodeExpireAt,
             Verified = Verified,
             RegionCode = RegionCode,
             Permissions = Permissions,
diff --git a/src/Plugins/BotSharp.Plugin.MongoStorage/Repository/MongoRepository.User.cs b/src/Plugins/BotSharp.Plugin.MongoStorage/Repository/MongoRepository.User.cs
index 29bd36beb..57ea76b96 100644
--- a/src/Plugins/BotSharp.Plugin.MongoStorage/Repository/MongoRepository.User.cs
+++ b/src/Plugins/BotSharp.Plugin.MongoStorage/Repository/MongoRepository.User.cs
@@ -132,6 +132,7 @@ public void UpdateUserVerificationCode(string userId, string verficationCode)
     {
         var filter = Builders<UserDocument>.Filter.Eq(x => x.Id, userId);
         var update = Builders<UserDocument>.Update.Set(x => x.VerificationCode, verficationCode)
+            .Set(x => x.VerificationCodeExpireAt, DateTime.UtcNow.AddMinutes(5))
             .Set(x => x.UpdatedTime, DateTime.UtcNow);
         _dc.Users.UpdateOne(filter, update);
     }