diff --git a/spec/unit/crypto/verification/request.spec.js b/spec/unit/crypto/verification/request.spec.js
index 558e2880d..ef0ea8586 100644
--- a/spec/unit/crypto/verification/request.spec.js
+++ b/spec/unit/crypto/verification/request.spec.js
@@ -69,8 +69,14 @@ describe("verification request", function() {
         bob.on("crypto.verification.request", (request) => {
             const bobVerifier = request.beginKeyVerification(verificationMethods.SAS);
             bobVerifier.verify();
+
+            // XXX: Private function access (but it's a test, so we're okay)
+            bobVerifier._endTimer();
         });
         const aliceVerifier = await alice.requestVerification("@bob:example.com");
         expect(aliceVerifier).toBeAn(SAS);
+
+        // XXX: Private function access (but it's a test, so we're okay)
+        aliceVerifier._endTimer();
     });
 });
diff --git a/spec/unit/crypto/verification/sas.spec.js b/spec/unit/crypto/verification/sas.spec.js
index 59df685b4..716c0f009 100644
--- a/spec/unit/crypto/verification/sas.spec.js
+++ b/spec/unit/crypto/verification/sas.spec.js
@@ -57,6 +57,9 @@ describe("SAS verification", function() {
         await sas.verify()
             .catch(spy);
         expect(spy).toHaveBeenCalled();
+
+        // Cancel the SAS for cleanup (we started a verification, so abort)
+        sas.cancel();
     });
 
     describe("verification", function() {
diff --git a/src/crypto/verification/Base.js b/src/crypto/verification/Base.js
index a55be4953..5219b0124 100644
--- a/src/crypto/verification/Base.js
+++ b/src/crypto/verification/Base.js
@@ -78,7 +78,7 @@ export default class VerificationBase extends EventEmitter {
         if (this._transactionTimeoutTimer !== null) {
             clearTimeout(this._transactionTimeoutTimer);
         }
-        setTimeout(() => {
+        this._transactionTimeoutTimer = setTimeout(() => {
            if (!this._done && !this.cancelled) {
                console.log("Triggering verification timeout");
                this.cancel(timeoutException);
@@ -86,6 +86,13 @@ export default class VerificationBase extends EventEmitter {
         }, 10 * 60 * 1000); // 10 minutes
     }
 
+    _endTimer() {
+        if (this._transactionTimeoutTimer !== null) {
+            clearTimeout(this._transactionTimeoutTimer);
+            this._transactionTimeoutTimer = null;
+        }
+    }
+
     _sendToDevice(type, content) {
         if (this._done) {
             return Promise.reject(new Error("Verification is already done"));
@@ -131,12 +138,14 @@ export default class VerificationBase extends EventEmitter {
     }
 
     done() {
+        this._endTimer(); // always kill the activity timer
         if (!this._done) {
             this._resolve();
         }
     }
 
     cancel(e) {
+        this._endTimer(); // always kill the activity timer
         if (!this._done) {
             this.cancelled = true;
             if (this.userId && this.deviceId && this.transactionId) {
@@ -196,10 +205,12 @@ export default class VerificationBase extends EventEmitter {
         this._promise = new Promise((resolve, reject) => {
             this._resolve = (...args) => {
                 this._done = true;
+                this._endTimer();
                 resolve(...args);
             };
             this._reject = (...args) => {
                 this._done = true;
+                this._endTimer();
                 reject(...args);
             };
         });