This would be a good question for data security board.
The expiry time of the authentication code should depend entirely on currently required level of security and should vary from user to user individually. The time periods will also depend on the security level. If you set security levels as 1, 2, 4, 8, 10 etc., you can divide my example numbers by the level of security.
level 1 - 20 min - Working as usual, no threats detected. Requesting new code allowed.
level 2 - 10 min - Threats detected, potential breach. Requesting new code allowed upon old code expiry.
level 4 - 5 min - Potential brute force attack. Requesting new code allowed upon old code expiry time + additional wait time required (ex. additional 5 mins).
level 8 - 2.5 min - Brute force attack confirmed. User is unable to request new code until attack is no longer taking place.
level 10 - 0 min - Account is blocked, additional assistance required.
Bear in mind, this is just an example draft and should be re-designed is ever used for an actual system.
As an example of a similar approach you can research http://store.steampowered.com/ authentication system.