diff --git a/graph/mutators/action.js b/graph/mutators/action.js
index 29a6e67af..06417844b 100644
--- a/graph/mutators/action.js
+++ b/graph/mutators/action.js
@@ -1,4 +1,5 @@
 const errors = require('../../errors');
+const UsersService = require('../../services/users');
 const {CREATE_ACTION, DELETE_ACTION} = require('../../perms/constants');
 const {
   IGNORE_FLAGS_AGAINST_STAFF,
@@ -82,11 +83,17 @@ const createAction = async (ctx, {item_id, item_type, action_type, group_id, met
     metadata
   });
 
-  if (action_type === 'FLAG' && item_type === 'COMMENTS') {
+  if (action_type === 'FLAG') {
+    if (item_type === 'USERS') {
 
-    // The item is a comment, and this is a flag. Push that the comment was
-    // flagged, don't wait for it to finish.
-    pubsub.publish('commentFlagged', item);
+      // Set the user's status as pending, as we need to review it.
+      await UsersService.setStatus(item_id, 'PENDING');
+    } else if (item_type === 'COMMENTS') {
+
+      // The item is a comment, and this is a flag. Push that the comment was
+      // flagged, don't wait for it to finish.
+      pubsub.publish('commentFlagged', item);
+    }
   }
 
   return action;
diff --git a/services/users.js b/services/users.js
index e0f7d1599..fbaf89609 100644
--- a/services/users.js
+++ b/services/users.js
@@ -395,18 +395,34 @@ module.exports = class UsersService {
       throw new Error(`status ${status} is not supported`);
     }
 
-    // TODO: current updating status behavior is weird.
-    // once a user has been `APPROVED` its status cannot be
-    // changed anymore.
-    const user = await UserModel.findOneAndUpdate({
-      id,
-      status: {
-        $ne: 'APPROVED'
-      }
-    }, {
+    // Compose the query.
+    const query = {id};
+
+    // Insert extra validations into the query.
+    switch (status) {
+    case 'ACTIVE':
+    case 'BANNED':
+    case 'APPROVED':
+
+      // A user cannot become change their status from what it is already.
+      query.status = {
+        $ne: status,
+      };
+      break;
+    case 'PENDING':
+
+      // A user cannot become pending if they are already approved, pending, or
+      // banned
+      query.status = {
+        $nin: [status, 'APPROVED', 'BANNED'],
+      };
+      break;
+    }
+
+    const user = await UserModel.findOneAndUpdate(query, {
       $set: {
-        status
-      }
+        status,
+      },
     }, {
       new: true,
     });
@@ -426,8 +442,8 @@ module.exports = class UsersService {
           };
         await MailerService.sendSimple(options);
       }
-
     }
+
     return user;
   }