Related, if you're making the wrong assumption that email is instantaneous and a short expiration time is acceptable, give people an easy way to have a fresh code re-sent when the first code that goes out expires before it's received instead of being all, "well, I guess we don't really want your $800 order".