diff --git a/src/users.js b/src/users.js
index 8773f59f4..2b2c4ee83 100644
--- a/src/users.js
+++ b/src/users.js
@@ -748,6 +748,7 @@ async function getInviteLink(user, auditSource) {
     assert.strictEqual(typeof auditSource, 'object');
 
     if (user.source) throw new BoxError(BoxError.CONFLICT, 'User is from an external directory');
+    if (!user.inviteToken) throw new BoxError(BoxError.BAD_STATE, 'User already used invite link');
 
     const directoryConfig = await settings.getDirectoryConfig();
     let inviteLink = `${settings.dashboardOrigin()}/setupaccount.html?inviteToken=${user.inviteToken}&email=${encodeURIComponent(user.email)}`;
@@ -764,13 +765,6 @@ async function sendInviteEmail(user, email, auditSource) {
     assert.strictEqual(typeof email, 'string');
     assert.strictEqual(typeof auditSource, 'object');
 
-    // not sure if this can ever be the case
-    if (!user.inviteToken) {
-        const inviteToken = hat(256);
-        user.inviteToken = inviteToken;
-        await update(user, { inviteToken }, auditSource);
-    }
-
     const resetLink = await getInviteLink(user, auditSource);
     await mailer.sendInvite(user, null /* invitor */, email, resetLink);
 }