diff --git a/app/Http/Controllers/InvitationsController.php b/app/Http/Controllers/InvitationsController.php
index 78c5b87..705323a 100644
--- a/app/Http/Controllers/InvitationsController.php
+++ b/app/Http/Controllers/InvitationsController.php
@@ -11,6 +11,8 @@ class InvitationsController extends Controller
     {
         $invitation = Invitation::findByCode($code);
 
+        abort_if($invitation->hasBeenUsed(), 404);
+
         return view('invitations.show', [
             'invitation' => $invitation,
         ]);
diff --git a/app/Invitation.php b/app/Invitation.php
index 16e6f34..79d93e3 100644
--- a/app/Invitation.php
+++ b/app/Invitation.php
@@ -8,6 +8,11 @@ class Invitation extends Model
 {
     public static function findByCode($code)
     {
-        return self::where('code', $code)->first();
+        return self::where('code', $code)->firstOrFail();
+    }
+
+    public function hasBeenUsed()
+    {
+        return $this->user_id !== null;
     }
 }
diff --git a/database/migrations/2017_12_08_173739_create_invitations_table.php b/database/migrations/2017_12_08_173739_create_invitations_table.php
index 2391bda..05bbff0 100644
--- a/database/migrations/2017_12_08_173739_create_invitations_table.php
+++ b/database/migrations/2017_12_08_173739_create_invitations_table.php
@@ -15,6 +15,7 @@ class CreateInvitationsTable extends Migration
     {
         Schema::create('invitations', function (Blueprint $table) {
             $table->increments('id');
+            $table->unsignedInteger('user_id')->nullable();
             $table->string('code');
             $table->timestamps();
         });
diff --git a/tests/Feature/AcceptInvitationTest.php b/tests/Feature/AcceptInvitationTest.php
index 943a6b3..8e63867 100644
--- a/tests/Feature/AcceptInvitationTest.php
+++ b/tests/Feature/AcceptInvitationTest.php
@@ -2,8 +2,9 @@
 
 namespace Tests\Feature;
 
-use Tests\TestCase;
+use App\User;
 use App\Invitation;
+use Tests\TestCase;
 use Illuminate\Foundation\Testing\WithFaker;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 
@@ -17,6 +18,7 @@ class AcceptInvitationTest extends TestCase
         $this->withoutExceptionHandling();
 
         $invitation = factory(Invitation::class)->create([
+            'user_id' => null,
             'code' => 'TESTCODE1234',
         ]);
 
@@ -26,4 +28,25 @@ class AcceptInvitationTest extends TestCase
         $response->assertViewIs('invitations.show');
         $this->assertTrue($response->data('invitation')->is($invitation));
     }
+
+    /** @test */
+    function viewing_a_used_invitation()
+    {
+        $invitation = factory(Invitation::class)->create([
+            'user_id' => factory(User::class)->create(),
+            'code' => 'TESTCODE1234',
+        ]);
+
+        $response = $this->get('/invitations/TESTCODE1234');
+
+        $response->assertStatus(404);
+    }
+
+    /** @test */
+    function viewing_an_invitation_that_does_not_exist()
+    {
+        $response = $this->get('/invitations/TESTCODE1234');
+
+        $response->assertStatus(404);
+    }
 }