Facebook Checkpoint Loop: Why It Keeps Asking to Verify

You finish Facebook's security check, tap continue, and land on the same screen again: "Your account has been locked", then "Get started", then confirm your identity. You do it a second time, then a third. In Malaysia people call this kena checkpoint, and after an hour of it the account feels gone.

It usually is not gone. A repeating check normally means Facebook still does not trust the login, and every quick retry from a new phone, a new network or a fresh code request can make that worse. The way out is to stop, reset the conditions, and try once in the way Meta's pages describe.

This guide is about the loop itself. It covers why the check repeats, a calm reset plan, what to do when the loop is a code screen, how to tell whether someone else is still in the account, and the "buka checkpoint" sellers who target people stuck here. If this is your first lock, start with our guide to a Facebook account locked for unusual activity.

Last checked: 5 October 2026.

#Why Does Facebook Keep Asking You to Confirm Your Identity?

Because it still thinks the account may not be safe. Meta's page on security checks says it asks for one when it thinks your account's security might have been affected, and its unlock page says it may lock an account when it sees unusual activity. Meta does not publish a list of triggers, but its pages keep pointing to the same fixes: use a device you have logged in from before, give the date of birth you used at sign-up, and wait a day if you have requested several codes. When the email, phone or password were changed by someone else, the checkpoint is the wrong door, and Meta sends you to facebook.com/hacked instead. Only Meta can lift the lock.

#Which Loop Are You In?

"Checkpoint loop" covers several different screens. The exact wording varies by app version, language and region, so match the meaning rather than the words. Meta does not publish a page about loops as such, so the reasons and fixes in this table are our reading of its help pages at the time of writing, not Meta's own explanation.

#Why the Security Check Keeps Coming Back

Facebook decides whether a login looks like you. Meta does not explain its signals, so the points below are practical reasoning from its own advice rather than a published rule list.

• Repeated attempts. Ten tries in an hour do not look like a calm owner. Meta's unlock page says that if you have requested several codes already, you should wait a day before trying again.
• New devices and networks. Meta's recovery hub says that for best results you should use a device you have used to log in before. Hopping between a borrowed phone, office Wi-Fi and mobile data gives Facebook a new picture each time.
• VPNs and proxies. Meta does not mention them on these pages, so this point is our inference: a VPN makes your login appear to come from somewhere else, which works against the familiar-device advice. Switch it off for the attempt.
• Wrong answers. The security check page says the date of birth it asks for is the one you gave when you signed up, which may not match the profile today.
• A browser Facebook cannot remember. Meta's page on two-factor authentication says private browsing, or a browser that clears its history when it closes, may mean you are asked for a security code each time.
• Someone else in the account. If an attacker still has a session or your password, new suspicious activity can trigger a fresh lock after you clear the old one.

#How to Break the Loop: A Calm 24-Hour Reset

The aim is one clean attempt that looks exactly like your normal login. Do it in this order.

1. Stop. Close Facebook on every device and do not request another code. If a check has just finished, Meta's page on the 24-hour wait says you will have to wait 24 hours to log in, as an extra precaution, and friends can still see your profile in the meantime.
2. While you wait, check the email inbox and phone number on the account still work. Read Facebook's recent emails and screenshot anything about a changed email, phone or password.
3. Pick your attempt device: the phone or computer you normally use for Facebook, with the app updated or a normal browser window, not private mode.
4. Use your usual network, such as home Wi-Fi or your own mobile data. Turn off any VPN, which keeps the login looking familiar even though Meta's pages do not mention VPNs.
5. After a full day, open Facebook, tap "Get started" and follow each step once, slowly. Give the date of birth from sign-up. If a security question is impossible, Meta says you may be able to pick a different one or try again another time.
6. If a screen shows a login or change you do not recognise, say it was not you. If offered a new password, choose one you have never used elsewhere.
7. If the check finishes and Facebook asks you to wait, wait. Do not start the process on another phone.

In Malaysia, an expired prepaid line can also stop codes arriving. If the line has expired or your phone shows no service out of nowhere, contact your carrier from another phone. Our guide to a Facebook login code that never arrives covers delivery problems in more detail. If the check that keeps failing is a video selfie, read our page on a Facebook video selfie that is not working.

#When the Loop Is a Two-Factor Code Screen

Some loops are not a lock at all. If Facebook accepts your password and then asks for a two-factor code you cannot get, follow Meta's two-factor troubleshooting page. It suggests trying these in order: wait a few minutes for a delayed SMS, approve the login from another phone, tablet or browser that is still logged in, then enter one of your saved recovery codes.

If none of those work, the same page says to go to the code screen and look for the help link: "Need another way to authenticate?" on a computer, "Having trouble?" on Android or a mobile browser, and "Need help?" on iPhone or iPad. That starts an identity confirmation, which Meta says is not available in Facebook Lite, so use the full app or facebook.com in a browser.

#When the Loop Means Someone Else Is Still In

A lock that keeps returning after you clear it is a warning sign. Meta's page on recovering a hacked account lists signs such as a changed profile picture, posts or messages you did not write, two-factor that stops working, and emails saying an email address, phone number or password was changed when it was not you.

1. Leave the checkpoint and go to facebook.com/hacked on a device you have used to log in before.
2. If an email says your address was changed, open it in your old inbox. Meta says it sends a special link to the previous address that can reverse the change.
3. If you cannot reach the email or phone, use Meta's Account Recovery hub, choose your issue, and follow the steps. Meta notes it may prompt you to find your hacked account and says to proceed even if you were not hacked.
4. Once you are in, open Where you're logged in under Password and security. Meta's page on logging out of other devices shows how to select unknown sessions, or all of them, and log them out.
5. Change the password and turn on two-factor authentication before you do anything else.

Our walkthrough of what to do when the hacker changed your email and phone goes further into that case.

#"Buka Checkpoint" Sellers and Other Scams

Search "buka checkpoint facebook" or post about a loop in a group, and offers often follow, in Malay, English or Chinese. Some claim a tool that skips the check. Some claim a contact at Meta. Many ask for your password, the code Facebook just sent, your backup codes, or remote access to your phone so they can "do it for you". Those details are exactly what an attacker needs to take the account, or to keep it.

• Red flag: a promise to unlock or recover the account for certain.
• Red flag: a claim of special access or a contact inside Meta.
• Red flag: any request for a code, a password, backup codes, a screen share or a remote access app.
• Red flag: payment demanded before anyone has looked at what happened.
• What legitimate help looks like: a case review first, only Meta's own forms and flows, best effort, and an honest statement that Meta decides and some accounts do not come back.

Meta's page on checking whether an email is really from Facebook lists the domains it uses, such as facebookmail.com and meta.com, and lets you confirm a message under Recent emails in Password and security. The government's NSRC 997 page says to call within 24 hours of discovering a scam so banks can act, contact the bank and make a police report. A phishing page or fake support account can be reported to CyberSecurity Malaysia's Cyber999, which helps Malaysian internet users escalate abuse reports. Our explainer on fake hackers offering account recovery shows the common scripts.

#Mistakes That Restart the Loop

• Requesting a new code every few minutes instead of waiting a day.
• Trying on a friend's phone, a cybercafe computer or a brand new handset.
• Logging in through a VPN or swapping between networks during the check.
• Using an incognito window, so Facebook cannot remember the browser.
• Entering the birthday now on the profile instead of the sign-up date.
• Starting the process again on another device during the 24-hour wait.
• Clearing the lock but leaving unknown sessions logged in and the old password in place.

#If Nothing Breaks the Loop

Sometimes the loop continues after a clean day's wait and a careful attempt. At that point, change route rather than repeating the same screen: the Account Recovery hub, facebook.com/hacked if anything was changed, or the two-factor help link if the loop is a code screen. Keep a short log of each attempt with the date, device and what the screen said, because it helps you avoid repeating what failed.

#When a Case Review Makes Sense

The steps above are the official route, and you can follow every one of them yourself. Nobody can skip Meta's check for you. A second opinion is worth having when the account runs your business Page or ads, when a takeover and a lock seem to have happened together, or when every route keeps landing on the same screen. SocialSafe by AwareXone, our recovery service, reviews what you have already tried and tells you honestly which official route is still open, if any. Our Facebook account recovery service explains how the review works, and our Trust Center lists what we will never ask for, starting with your password and codes.

#Frequently Asked Questions