Your password works, but Facebook or Instagram wants a login code you can’t get. Perhaps the text never arrives, or the authenticator app was on a phone you no longer have.
This is frustrating, but it’s often a different problem from a hacked account, and it has its own recovery options. Try the steps below in order, starting with the quickest.
Before you start: is this really only a code problem?
If your password is still accepted and you’re stuck only at the code screen, carry on with this guide.
If you didn’t set up two-factor authentication yourself, or your email, phone or password have changed, someone else may have been in your account. In that case, go to my guide on what to do when a Facebook account is hacked.
Step 1: Check for simple delivery problems
If you use text message codes, wait a few minutes before you assume they’ve failed, because they can be delayed. Check that you have signal and that your phone’s message inbox isn’t full.
Avoid repeatedly requesting new codes, because it makes it harder to tell which one is current. If you use an authenticator app and its codes are rejected, check that your phone’s date and time are set automatically, as these apps depend on an accurate clock.
Step 2: Look for a device that’s still logged in
This is easy to overlook, so check every device you’ve used, including an old phone, a tablet and a work laptop.
On Facebook, if you’re logged in on another device, check your notifications there. You may see a prompt to approve the new login.
If you find a logged-in device on either platform, keep it signed in. You may be able to use it to update your two-factor settings once you’ve recovered access, as described below.
Facebook may also skip the code on a browser or device you previously chose to save. Try logging in from one you use regularly, in a normal window and not in private browsing.
Step 3: Use a recovery or backup code
When you set up two-factor authentication, you may have been offered a set of one-time codes. Facebook calls these recovery codes, and Instagram calls them backup codes.
Search for them in:
- Your password manager
- Screenshots and photos on your phone or cloud backup
- Notes apps and files on your computer
- Printed documents or a notebook
Enter one in place of the normal login code. Each one works only once, so cross it off after you use it.
Step 4: Recover your authenticator app, if possible
If you changed phones, your codes may not be lost. Some authenticator apps offer cloud backup or sync, so sign in to the same app on your new phone with the account you used before. If you still have the old phone, even with a cracked screen or no SIM, try to get it working long enough to open the app.
If you’ve lost a text-message number, ask your mobile carrier whether you can get a replacement SIM for it. Availability depends on your carrier and whether the number is still yours.
Step 5: Ask Facebook or Instagram to confirm your identity
If you can’t get a code by any of those routes, use the help link on the code screen. On Facebook, it depends on the device you’re using:
| Where you’re logging in | What to look for |
|---|---|
| Computer | Need another way to authenticate?, then Other options, then Get more help |
| Android or mobile web | Having trouble? |
| iPhone or iPad | Need help? |
These labels can change, and Instagram’s screens differ, so look for the closest option on your screen, such as a link saying you can’t access your phone or codes.
Facebook says it may ask for a photo of your government ID, answers to account security questions, or confirmation from trusted contacts. Not every account is offered the same options. It says it typically replies within one to two working days, using the email or phone number on your account, so check that you can still get into those. That’s not a guarantee of how your case will go, and some requests take longer or aren’t successful.
If you’re using the Facebook Lite app, switch to the main app or a web browser, because Facebook says identity confirmation isn’t available in Lite.
If those routes don’t help, try facebook.com/hacked, which Meta also points people to, and check Meta’s Account Recovery Hub.
Mistakes to avoid
- Buying a “bypass” or “2FA removal”. Two-factor authentication exists to stop this kind of access. Sellers offering it are at best unreliable, and they may be running a scam.
- Sharing your password or codes. Nobody legitimately helping you should need them. Meta also says it will never ask for your password by email.
- Submitting blurry or inconsistent documents. Follow the instructions closely and use details that match the account.
- Logging out of a working session. A device that’s still signed in may be your best way back in.
Once you’re back in, prevent it from happening again
Don’t turn two-factor authentication off, as it’s still worth having. Instead, make sure that losing one phone can’t lock you out again:
- Save new recovery codes. In Accounts Center, go to Password and security, then Two-factor authentication, select your account, then Additional methods. Store the codes somewhere you can reach without your phone.
- Add a second method. An authenticator app, a security key or a phone number gives you another way in.
- Consider an app or key over SMS, especially if you travel or change numbers.
- Update your email and phone number, and remove any you no longer use.
- Move your codes before you change phones. Keep the old phone until you’ve confirmed you can log in from the new one.
If a business relies on the account, make sure more than one trusted person has appropriate access to your Pages and ad accounts through your business tools. Don’t solve this by sharing one login.
Frequently asked questions
Can I turn off two-factor authentication without logging in?
Not directly. You need to get in first, using a code, a saved device or the identity route, and then you can change your settings. Be wary of anyone who says they can remove it from the outside.
What if I’ve lost my recovery codes as well?
Check for a logged-in device first, then try the help link on the code screen. If you’re logged in on any device, you can usually generate a new set from Accounts Center.
Will getting a new SIM or phone fix it?
A replacement SIM with the same number may restore text-message codes. A new phone alone won’t restore an authenticator app unless the app has a backup you can restore.
How long does identity confirmation take?
Facebook says it typically replies within one to two working days, but it doesn’t promise an outcome, and your case may take longer. Keep the email or phone on your account accessible while you wait.
Can someone recover my account for me?
They can guide you, but you’re the one who needs to complete the checks. Legitimate help uses Meta’s own routes and doesn’t involve special access or bypasses.
Still stuck?
Most 2FA lockouts are worth working through yourself first, because the official routes are free. If you’ve tried them and you’re still stuck, or the account runs a business you depend on, you can request a recovery review.
Tell me what you’ve tried, and I’ll tell you honestly whether I can help. I work only with rightful owners or their authorized representatives, I’m not affiliated with Meta, and I can’t guarantee recovery. You can also read about past 2FA and hacked-account cases. Please don’t send passwords, login codes, backup codes or ID documents in your first message.