diff --git a/app/controllers/concerns/idv/phone_question_ab_test_concern.rb b/app/controllers/concerns/idv/phone_question_ab_test_concern.rb
index 69a8e082d9a..30260e58af2 100644
--- a/app/controllers/concerns/idv/phone_question_ab_test_concern.rb
+++ b/app/controllers/concerns/idv/phone_question_ab_test_concern.rb
@@ -14,6 +14,7 @@ def phone_question_user
 
     def maybe_redirect_for_phone_question_ab_test
       return if phone_question_ab_test_bucket != :show_phone_question
+      return if request.referer.blank? # avoid redirect loop
       return if request.referer == idv_phone_question_url
       return if request.referer == idv_link_sent_url
       return if request.referer == idv_hybrid_handoff_url
diff --git a/spec/features/idv/doc_auth/hybrid_handoff_spec.rb b/spec/features/idv/doc_auth/hybrid_handoff_spec.rb
index b6bd723911b..0008895d958 100644
--- a/spec/features/idv/doc_auth/hybrid_handoff_spec.rb
+++ b/spec/features/idv/doc_auth/hybrid_handoff_spec.rb
@@ -201,6 +201,11 @@
         expect(page).to have_current_path(idv_phone_question_path)
         click_link t('doc_auth.buttons.have_phone')
 
+        # added to test FlowPolicy behavior with PhoneQuestion
+        expect(page).to have_current_path(idv_hybrid_handoff_path)
+        visit(idv_link_sent_url)
+        expect(page).to have_current_path(idv_hybrid_handoff_path)
+
         freeze_time do
           idv_send_link_max_attempts.times do
             expect(page).to_not have_content(