diff --git a/app/controllers/submit_form_email_2fas_controller.rb b/app/controllers/submit_form_email_2fas_controller.rb
index 377f99cab..511daaf65 100644
--- a/app/controllers/submit_form_email_2fas_controller.rb
+++ b/app/controllers/submit_form_email_2fas_controller.rb
@@ -10,6 +10,8 @@ class SubmitFormEmail2fasController < ApplicationController
 
   def create
     RateLimit.call("verify-2fa-code-#{@submitter.id}", limit: 2, ttl: 45.seconds, enabled: true)
+    RateLimit.call("verify-2fa-code-1h-#{@submitter.id}", limit: 10, ttl: 1.hour, enabled: true)
+    RateLimit.call("verify-2fa-code-1d-#{@submitter.id}", limit: 20, ttl: 1.day, enabled: true)
 
     value = [@submitter.email.downcase.strip, @submitter.slug].join(':')
 
diff --git a/lib/submitters.rb b/lib/submitters.rb
index 68fe86aaa..b7a7a7dd1 100644
--- a/lib/submitters.rb
+++ b/lib/submitters.rb
@@ -277,8 +277,11 @@ module Submitters
   def verify_link_otp!(otp, submitter)
     return false if otp.blank?
 
-    RateLimit.call("verify-2fa-code-#{Digest::MD5.base64digest(submitter.email.downcase.squish)}",
-                   limit: 2, ttl: 45.seconds, enabled: true)
+    email_digest = Digest::MD5.base64digest(submitter.email.downcase.squish)
+
+    RateLimit.call("verify-2fa-code-#{email_digest}", limit: 2, ttl: 45.seconds, enabled: true)
+    RateLimit.call("verify-2fa-code-1h-#{email_digest}", limit: 10, ttl: 1.hour, enabled: true)
+    RateLimit.call("verify-2fa-code-1d-#{email_digest}", limit: 20, ttl: 1.day, enabled: true)
 
     link_2fa_key = [submitter.email.downcase.squish, submitter.submission.template.slug].join(':')