I cannot get my Facebook two factor code

This one is quietly frustrating, because the thing keeping you out is the thing you turned on to keep other people out, and it is working exactly as designed. Nearly always the cause is an old mobile number, or an authentication app that was on a phone you have since replaced. There is a way back, and there is also a five minute job to do afterwards so it never happens again.

Last checked: 15 August 2026. Every official Facebook, Instagram and Australian government link on this page was opened and confirmed working on that date. If you find one that no longer works, please tell us and we will fix it, because a dead link on a page like this is worse than no page at all.

First, look for your recovery codes

When you switched two factor authentication on, Facebook offered you a list of recovery codes and suggested you keep them. If you printed them, wrote them in a notebook, or saved them in a password manager, this is the moment they were made for. Any one of them gets you in without the phone.

Worth checking: the back of a diary, a note in a filing drawer, an email you sent yourself, or a saved note on another device. People store them and forget they did.

If you do not have the codes

The device trick matters especially here. Facebook is far more willing to offer alternatives on a device it has seen on the account before, because that is itself a form of evidence. Trying from a strange computer is the most likely way to end up stuck.

If the phone number is simply out of date

This is the usual story. The number on the account belongs to a phone or a plan you no longer have, so the text message goes nowhere. If your old number was transferred to your current phone, try again, because it may work. If the number is genuinely gone, you are into the identity confirmation route below.

Facebook explains how the whole system works here: how two factor authentication works on Facebook.

Once you are back in, spend five minutes on this

1. Update the mobile number on the account to the phone you actually use now.
2. Generate a fresh set of recovery codes and put them somewhere that is not your phone. A piece of paper in a drawer is fine and survives a lost handset.
3. If you use an authentication app, add it to a second device as well, or make sure the app itself backs up, so a broken phone is not a locked account.
4. Do not turn two factor authentication off. It is the single most effective thing protecting the account, and being locked out is a fixable inconvenience whereas being taken over is not.

One warning specific to this situation

Because you are waiting for a code, you are unusually likely to be caught by a code scam. Nobody legitimate will ever ask you to read out a code, forward one, or send one to a friend who says they are locked out. That code is the last thing standing between an attacker and your account, and asking for it is the whole trick.

• Anyone offering a phone number. There is no Meta support line. A number is the clearest single sign you are being scammed.
• Paid recovery agents. Services that promise to get your account back for a fee. They have no access Meta does not give you for free, and the usual outcome is that you pay and nothing happens.
• Anyone who messages you offering to help after you post that you have been hacked, especially on Instagram. Watching for those posts is exactly how they find people.
• Anyone asking for an upfront fee, a gift card, a voucher or a cryptocurrency payment. No legitimate service is paid this way.
• Anyone asking for your password or your two factor code. No real Meta process ever asks a person for these. Sharing the code is how the second theft happens.
• Anyone asking to remote control your computer to fix it for you, unless it is somebody you already know and trust.
• A friend asking you to receive a code for them. That friend has already been taken over, and the code is for your account.

Related pages on this site

• Start at the router , if this is not quite your situation.
• There is no Meta phone number , and what the numbers really are.
• Paid recovery services , why none of them are real.
• The full Facebook page .
• Password managers explained simply , a good place to keep recovery codes.