diff --git a/src/api/core/two_factor/email.rs b/src/api/core/two_factor/email.rs
index 460caa7b..63e4508b 100644
--- a/src/api/core/two_factor/email.rs
+++ b/src/api/core/two_factor/email.rs
@@ -286,7 +286,7 @@ impl EmailTokenData {
     }
 
     pub fn add_attempt(&mut self) {
-        self.attempts += 1;
+        self.attempts = self.attempts.saturating_add(1);
     }
 
     pub fn to_json(&self) -> String {
diff --git a/src/api/core/two_factor/protected_actions.rs b/src/api/core/two_factor/protected_actions.rs
index 04ab08f5..04c273ef 100644
--- a/src/api/core/two_factor/protected_actions.rs
+++ b/src/api/core/two_factor/protected_actions.rs
@@ -51,7 +51,7 @@ impl ProtectedActionData {
     }
 
     pub fn add_attempt(&mut self) {
-        self.attempts += 1;
+        self.attempts = self.attempts.saturating_add(1);
     }
 
     pub fn time_since_sent(&self) -> TimeDelta {