diff --git a/lib/libutil/pw_util.c b/lib/libutil/pw_util.c
index 053ac56901f1..73d544b7a1d8 100644
--- a/lib/libutil/pw_util.c
+++ b/lib/libutil/pw_util.c
@@ -475,8 +475,7 @@ pw_copy(int ffd, int tfd, struct passwd *pw, struct passwd *old_pw)
 		*q = '\0';
 		fpw = pw_scan(r, PWSCAN_MASTER);
 		*q = t;
-		if ((old_pw && !pw_equal(fpw, old_pw)) ||
-		    (!old_pw && strcmp(fpw->pw_name, pw->pw_name))) {
+		if (strcmp(fpw->pw_name, pw->pw_name) != 0) {
 			/* nope */
 			free(fpw);
 			if (write(tfd, p, q - p + 1) != q - p + 1)
@@ -484,6 +483,12 @@ pw_copy(int ffd, int tfd, struct passwd *pw, struct passwd *old_pw)
 			++q;
 			continue;
 		}
+		if (old_pw && !pw_equal(fpw, old_pw)) {
+			warnx("entry inconsistent");
+			free(fpw);
+			errno = EINVAL; /* hack */
+			goto err;
+		}
 		free(fpw);
 
 		/* it is, replace it */