A flaw with this is that people will be able to share the support code that they need to enter.
A better way would be to make a unique hash for each user with a timestamp and username (for example) and have the bot decode it. That way codes specified will expire after a certain length of time.