This problem is almost always due to the person reading the code wrong on their mobile phone, particularly on devices where the text is not very refined.
The most common character culprits are lower case L's, numeral 1's, and upper case I's, and zeroes and upper case O's, which can also look the same in mobile phone text.
Code sent was zI3ODg, but user entered it as zl30Dg. In this case the upper case I was mistaken for a lower case L, and the upper case O was mistaken for a zero.
Another less-common problem is not observing letter case when entering the code. The codes are case sensitive.
If you are assisting your constituent in this, you can go into Constituent Manager, view their Profile tab, scroll down to Contact Info, click on the "Verify" link next to the mobile phone number and enter the code, substituting any characters that might be easily confused with another (e.g. 1 for l, O for 0, etc).