diff --git a/src/lib/im-api.js b/src/lib/im-api.js
index 9908ff09..215ba245 100644
--- a/src/lib/im-api.js
+++ b/src/lib/im-api.js
@@ -76,10 +76,16 @@ const REASON_MESSAGES = {
   YOUTH_MODE_RESTRICTED: '青少年模式下无法使用此功能',
   RISK_CONFIRMATION_REQUIRED: '需要先完成安全确认',
   RISK_ACTION_BLOCKED: '该操作已被安全策略拦截',
-  // 独立密码校验的两个 reason（对接文档 809 行有写），青少年模式关闭/开启走的都是这条接口。
-  // 原来没收录，报错时直接透传后端英文原文——PIN 输错显示 "code invalid"，连续错误锁定后
-  // 显示 "too many attempts"，且不告诉用户要等多久能重试。
-  CODE_INVALID: '独立密码不正确',
+  // CODE_INVALID is shared by two unrelated verify endpoints -- independent-password PIN check
+  // (青少年模式关闭/开启走的这条接口，对接文档 809 行) *and* the plain SMS verification-code
+  // verify endpoints (/auth/verification-codes/{id}/verify, /security/challenges/{id}/verify --
+  // confirmed live: entering a wrong SMS code on the "忘记独立密码?" identity-check screen also
+  // gets back reason=CODE_INVALID). This table only keys off the reason string with no per-call-site
+  // override, so a message written for just one of the two ("独立密码不正确") showed up verbatim on
+  // the *other* endpoint's screen, where there's no "独立密码" concept in view at all -- confusing,
+  // wrong-sounding copy for a real, correctly-rejected wrong code. Kept generic enough to be accurate
+  // for both rather than wrong in either.
+  CODE_INVALID: '验证码或独立密码不正确',
   TOO_MANY_ATTEMPTS: details => details && details.retry_after_seconds
     ? `连续输错次数过多，请 ${details.retry_after_seconds} 秒后重试`
     : '连续输错次数过多，请稍后重试'