diff --git a/src/challenge-module/challenge-pin.cpp b/src/challenge-module/challenge-pin.cpp
index 2dd4acf..c5825f9 100644
--- a/src/challenge-module/challenge-pin.cpp
+++ b/src/challenge-module/challenge-pin.cpp
@@ -79,6 +79,7 @@
     // check rest attempt times
     if (std::get<2>(parsedSecret) > 1) {
       int restAttemptTimes = std::get<2>(parsedSecret) - 1;
+      request.setStatus(WRONG_CODE);
       request.setChallengeSecrets(generateStoredSecrets(std::get<0>(parsedSecret),
                                                         std::get<1>(parsedSecret),
                                                         restAttemptTimes));
diff --git a/tests/unit-tests/challenge-pin.t.cpp b/tests/unit-tests/challenge-pin.t.cpp
index 9911b1a..6960162 100644
--- a/tests/unit-tests/challenge-pin.t.cpp
+++ b/tests/unit-tests/challenge-pin.t.cpp
@@ -83,9 +83,9 @@
   request.setChallengeSecrets(json);
 
   JsonSection infoJson;
-  infoJson.put(ChallengePin::JSON_PIN_CODE, "123");
+  infoJson.put(ChallengePin::JSON_PIN_CODE, "1234");
   std::stringstream ss;
-  boost::property_tree::write_json(ss, json);
+  boost::property_tree::write_json(ss, infoJson);
   std::string jsonString = ss.str();
   Block jsonContent = makeStringBlock(ndn::tlv::NameComponent, ss.str());
 
@@ -100,6 +100,41 @@
   BOOST_CHECK_EQUAL(request.getChallengeSecrets().empty(), true);
 }
 
+BOOST_AUTO_TEST_CASE(OnValidateInterestComingWithWrongCode)
+{
+  auto identity = addIdentity(Name("/ndn/site1"));
+  auto key = identity.getDefaultKey();
+  auto cert = key.getDefaultCertificate();
+  CertificateRequest request(Name("/ndn/site1"), "123", cert);
+  request.setChallengeType("PIN");
+  request.setStatus(ChallengePin::NEED_CODE);
+
+  time::system_clock::TimePoint tp = time::system_clock::now();
+  JsonSection json;
+  json.put(ChallengePin::JSON_CODE_TP, time::toIsoString(tp));
+  json.put(ChallengePin::JSON_PIN_CODE, "1234");
+  json.put(ChallengePin::JSON_ATTEMPT_TIMES, std::to_string(3));
+
+  request.setChallengeSecrets(json);
+
+  JsonSection infoJson;
+  infoJson.put(ChallengePin::JSON_PIN_CODE, "4567");
+  std::stringstream ss;
+  boost::property_tree::write_json(ss, infoJson);
+  std::string jsonString = ss.str();
+  Block jsonContent = makeStringBlock(ndn::tlv::NameComponent, ss.str());
+
+  Name interestName("/ndn/site1");
+  interestName.append("_VALIDATE").append("Fake-Request-ID").append("PIN").append(jsonContent);
+  Interest interest(interestName);
+
+  ChallengePin challenge;
+  challenge.handleChallengeRequest(interest, request);
+
+  BOOST_CHECK_EQUAL(request.getStatus(), ChallengePin::WRONG_CODE);
+  BOOST_CHECK_EQUAL(request.getChallengeSecrets().empty(), false);
+}
+
 BOOST_AUTO_TEST_CASE(ClientSendSelect)
 {
   ChallengePin challenge;