diff --git a/app/main/views/code_not_received.py b/app/main/views/code_not_received.py
index f125477fe..5fce56c3b 100644
--- a/app/main/views/code_not_received.py
+++ b/app/main/views/code_not_received.py
@@ -46,7 +46,7 @@ def verification_code_not_received():
     return render_template('views/verification-not-received.html')
 
 
-@main.route('/verification-not-received', methods=['POST'])
+@main.route('/send-new-code', methods=['GET'])
 def check_and_resend_verification_code():
     user = users_dao.get_user_by_id(session['user_id'])
     send_sms_code(user.id, user.mobile_number)
diff --git a/app/templates/views/verification-not-received.html b/app/templates/views/verification-not-received.html
index de1d9204f..674a33538 100644
--- a/app/templates/views/verification-not-received.html
+++ b/app/templates/views/verification-not-received.html
@@ -16,7 +16,7 @@ GOV.UK Notify
 
 
       <p>
-      <a class="button" href="two-factor" role="button">Resend verification code</a>
+      <a class="button" href="send-new-code" role="button">Resend verification code</a>
       </p>
   </div>
 </div>
diff --git a/tests/app/main/views/test_code_not_received.py b/tests/app/main/views/test_code_not_received.py
index b90fef3ba..c9b7ad2c9 100644
--- a/tests/app/main/views/test_code_not_received.py
+++ b/tests/app/main/views/test_code_not_received.py
@@ -124,11 +124,30 @@ def test_check_and_redirect_to_two_factor(notifications_admin,
             user = create_test_user('active')
             session['user_id'] = user.id
             _set_up_mocker(mocker)
-        response = client.post('/verification-not-received')
+        response = client.get('/send-new-code')
         assert response.status_code == 302
         assert response.location == 'http://localhost/two-factor'
 
 
+def test_should_create_new_code_for_user(notifications_admin,
+                                         notifications_admin_db,
+                                         notify_db_session,
+                                         mocker):
+    with notifications_admin.test_client() as client:
+        with client.session_transaction() as session:
+            user = create_test_user('active')
+            session['user_id'] = user.id
+            verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
+            _set_up_mocker(mocker)
+        response = client.get('/send-new-code')
+        assert response.status_code == 302
+        assert response.location == 'http://localhost/two-factor'
+        codes = verify_codes_dao.get_codes(user_id=user.id, code_type='sms')
+        assert len(codes) == 2
+        for x in ([used.code_used for used in codes]):
+            assert x is False
+
+
 def _set_up_mocker(mocker):
     mocker.patch("app.admin_api_client.send_sms")
     mocker.patch("app.admin_api_client.send_email")
diff --git a/tests/app/main/views/test_two_factor.py b/tests/app/main/views/test_two_factor.py
index 205130fb7..a8b129858 100644
--- a/tests/app/main/views/test_two_factor.py
+++ b/tests/app/main/views/test_two_factor.py
@@ -35,3 +35,23 @@ def test_should_return_400_with_sms_code_error_when_sms_code_is_wrong(notificati
                                data={'sms_code': '23456'})
         assert response.status_code == 400
         assert {'sms_code': ['Code does not match']} == json.loads(response.get_data(as_text=True))
+
+
+def test_should_login_user_when_multiple_valid_codes_exist(notifications_admin,
+                                                           notifications_admin_db,
+                                                           notify_db_session):
+    with notifications_admin.test_client() as client:
+        with client.session_transaction() as session:
+            user = create_test_user('active')
+            session['user_id'] = user.id
+            verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='sms')
+            verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
+            verify_codes_dao.add_code(user_id=user.id, code='34567', code_type='sms')
+        assert len(verify_codes_dao.get_codes(user_id=user.id, code_type='sms')) == 3
+        response = client.post('/two-factor',
+                               data={'sms_code': '23456'})
+        assert response.status_code == 302
+        print(user.id)
+        codes = verify_codes_dao.get_codes(user_id=user.id, code_type='sms')
+        # query will only return codes where code_used == False
+        assert len(codes) == 0