diff --git a/internal/service/client_auth/service.go b/internal/service/client_auth/service.go
index d9ec59e..d4ef74f 100644
--- a/internal/service/client_auth/service.go
+++ b/internal/service/client_auth/service.go
@@ -390,7 +390,7 @@ func (s *Service) checkAssetVerifyRateLimit(ctx context.Context, clientIP string
 func (s *Service) resolveAsset(ctx context.Context, identifier string) (string, uint, error) {
 	var card model.IotCard
 	if err := s.db.WithContext(ctx).
-		Where("iccid = ?", identifier).
+		Where("iccid = ? OR virtual_no = ?", identifier, identifier).
 		First(&card).Error; err == nil {
 		return assetTypeIotCard, card.ID, nil
 	} else if err != gorm.ErrRecordNotFound {
@@ -430,7 +430,7 @@ func (s *Service) verifyAssetToken(assetToken string) (*assetTokenClaims, error)
 		return nil, errors.New(errors.CodeInvalidParam)
 	}
 
-	parsed, err := jwt.ParseWithClaims(assetToken, &assetTokenClaims{}, func(token *jwt.Token) (interface{}, error) {
+	parsed, err := jwt.ParseWithClaims(assetToken, &assetTokenClaims{}, func(token *jwt.Token) (any, error) {
 		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
 			return nil, errors.New(errors.CodeInvalidToken)
 		}