Locked out by two-factor authentication on Instagram or Facebook: how to get back in

This guide covers one problem: you know your password but can’t get past the two-factor code step. If Instagram or Facebook locked the account for suspicious activity instead, see Instagram account locked or Facebook account locked.

Why you're stuck

Instagram's two-factor help page explains that when you set it up you choose a security method: an authentication app (which Instagram recommends) or another method such as a text message or WhatsApp, where available. After that, every login from a new device asks for a code or approval. If the method you chose is gone, for example a lost phone, a new SIM or a reset authenticator app, you'll see the code screen with no way to answer it.

Step 1: Try every method you might still have

1. Backup codes. Instagram's backup codes page says that if a code can't be sent, you can still log in with a backup code. Search your password manager, email drafts, screenshots, notes apps and printed documents for a list of 8-digit codes saved when you turned 2FA on.
2. A device that is still logged in. If Instagram or Facebook is still open on a tablet, laptop or old phone, you may be able to approve the login there, or get new backup codes from Accounts Center › Password and security › Two-factor authentication › Additional methods › Backup codes.
3. Another method. On the code screen, look for an option such as “Try another way” or “Need another way to confirm it's you” to switch to SMS, WhatsApp or email if those are set up.
4. Your old number. If you changed SIM but kept the same number, the SMS route may still work once the new SIM is active.
5. A restored authenticator. Some authenticator apps can restore accounts from a cloud backup on a new phone.

Step 2: If none of those work

Meta's Account Recovery Hub groups the official routes, including two-factor authentication help for Facebook, Instagram and Meta accounts and “I lost access to the email or mobile number on my account”.

• Instagram: from the login screen, use the help option for when you can't get a code, and follow the identity confirmation steps. Instagram's hacked account page explains that support may ask you to confirm the email or phone number you signed up with and the type of device you used, or, for accounts with photos of you, to take a video selfie.
• Facebook: use the option on the code screen to confirm your identity another way, and follow the steps. Facebook may ask you to confirm your identity with an ID; its accepted ID page lists what it takes.

Use a secure email address that only you can access for any support request, because that is where Meta will send next steps.

What to expect on timing

Identity checks for 2FA lockouts are often slower than ordinary password resets, partly because Meta adds waiting periods to protect against takeovers. Submit one complete request, then wait. Repeated attempts can restart the clock.

What not to do

• Don't turn to “2FA bypass” services. Anyone who can genuinely bypass two-factor for you could do it to anyone, and these offers are a common scam.
• Don't share codes that arrive unexpectedly. If you get a 2FA code you didn't request, someone may be trying to log in. Change your password once you're back in.
• Don't create a replacement account while you wait. It can complicate recovery and, on Facebook, you can only have one personal profile.

Set it up so this never happens again

• Save backup codes in two places, such as a password manager and a printed copy at home.
• Add a second method. Use an authenticator app plus WhatsApp or SMS on a number you'll keep.
• Use an authenticator with cloud backup or transfer it before you change phones.
• Keep your email address current in Accounts Center.
• Consider a passkey or security key, which the Account Recovery Hub lists among stronger options.
• If you run a business, make sure at least two people can access every Page, ad account and business portfolio.

When to get help

If you've tried every route and the identity check keeps failing, or the account holds a business you can't afford to lose, Unbanz can look at what has been tried and what is still possible. We are an independent service, not affiliated with Meta. Our free case check for Instagram account recovery or Facebook account recovery comes with a quote before any work starts. Accepted cases typically take an estimated 3–14 days. Recovery is guaranteed once we accept your case. We review every account first and only take cases we can win. We will never ask for your password or the codes Meta sends you.