Lost Instagram Backup Codes and Your 2FA Phone? Try This

You turned on two-factor authentication yourself, which was the right call. Then the phone with the authenticator app was lost, stolen or reset, and now Instagram says "Enter the 6-digit code" on your new phone. You never saved the backup codes, or you cannot find them.

The short answer: this is often fixable, but the order matters. Backup codes cannot be fetched from the login screen, so the best route runs through any device that is still signed in. If there is none, Instagram's phone, login link and identity check routes come next.

This guide is for owners locked out by their own two-factor setup. It covers each route in order, the mistakes that close doors, the scams aimed at people stuck here, and a setup that means a lost phone never locks you out again.

Last checked: 5 October 2026.

#Can You Log In to Instagram Without Backup Codes or Your Old Phone?

Often, yes. Instagram's page on backup codes says you must be logged in to see your codes or get a new list, so they cannot be recovered from the login screen. Your first move is to find a phone, tablet or computer where Instagram is still signed in, approve the new login there, then add an authenticator on your new phone and save fresh codes. With no signed-in device, try a text message or WhatsApp code if your number still works, then request a login link through "Forgot password?" and follow Instagram's support and identity check. Instagram reviews that request and makes the final decision, and nobody outside Meta can switch two-factor off for you.

#Why Backup Codes Cannot Be Recovered From the Login Screen

Backup codes stand in for the six-digit code when it cannot reach you. Instagram's two-factor page says they let you log in if you lose access to your phone or email and cannot get login codes.

The catch is where they live. The list sits under Accounts Center, Password and security, Two-factor authentication, Additional methods, Backup codes. That screen is inside the account. If no device is logged in, nobody can show you the list, including Instagram support. Anyone who says they can "pull" your backup codes is lying.

Some screens now say Meta Account settings instead of Accounts Center. Instagram says it is moving people across gradually, so menu names and button wording vary by app version and region.

#Which Route Fits Your Situation? A Quick Decision Table

Match what you still have to a row before you tap anything. Start at the top: the earlier routes are faster and need no review by Instagram.

#Route 1: Use a Device That Is Still Signed In

Search before you give up. An old tablet, a laptop browser, a work computer or a family phone may still hold your session. Instagram's page on login requests says that with two-factor on, it alerts you when a device it does not recognise tries to log in, and you can approve or deny the request straight away.

1. Start the login on your new phone and leave it on the code screen.
2. On the signed-in device, open Instagram and check notifications and Activity for the login request.
3. Tap "Approve" only if the device and location match what you are doing right now.
4. On the signed-in device, go to Accounts Center, Password and security, Two-factor authentication, and add an authentication app on your new phone.
5. In the same place, open Additional methods, Backup codes, and tap "Get new codes". Instagram says this cancels the old set.
6. Save the new codes somewhere off the phone before you close the screen.

Instagram's two-factor page also says a device you marked as trusted will not ask for a code when you log in again. If you ever tapped "Trust this device" on a home computer, try logging in there first.

If your Instagram shares an Accounts Center with a Facebook account you can still open, try the same path from Facebook. Instagram says two-factor protects your whole Meta Account, and its steps ask you to pick the profile on the two-factor screen, so linked profiles may appear there. Whether yours does depends on how the accounts were connected.

#Route 2: Get the Code by Text Message or WhatsApp

If text messages were one of your methods, the code still goes to your number, not your old handset. Instagram's SMS page says it texts a 6-digit security code each time someone logs in from a device it does not recognise. Its two-factor page adds that WhatsApp codes are available only if you turned on text messages first and then added WhatsApp.

• If you lost the phone but kept the number, ask your carrier for a replacement SIM on the same number. Ask what proof of ownership to bring before you visit.
• If WhatsApp was set up as a method and your WhatsApp now runs on a new phone, check it for the Instagram code.
• If a prepaid line expired and the number was reissued, codes go to the new owner. Skip to Route 3.
• If your phone suddenly shows "No service" while codes go missing, call your carrier from another phone and ask whether your SIM was swapped without your consent.

If texts simply never arrive, our guide to an Instagram security code that is not coming through covers delivery problems in detail.

#Route 3: The Login Link, Support Request and Identity Check

When no device and no code works, use the route Instagram describes on its page for a profile you cannot get into. It applies to lockouts as well as hacks.

1. On the login screen, tap "Forgot password?".
2. Enter your username, email or phone number, then tap "Send login link".
3. Complete the captcha and open the link from your email or text message.
4. If the link does not get you in, or brings you back to the code screen, request support from Instagram on a mobile device and give a secure email address only you can open.
5. Watch that inbox for Instagram's email with the next steps.

What Instagram asks for next depends on the account. For an account with photos of you, Instagram says it may ask for a video selfie of you turning your head in different directions. It says the video is never shown on Instagram and is deleted within 30 days, and that you can submit a new one if the first is not accepted. For an account without photos of you, it asks for the email or phone number you signed up with and the type of device you used at sign-up, such as iPhone, Android or iPad.

Instagram's page on lost email or phone access is blunt about one dead end: if you cannot open the email you registered with and never linked Instagram to Facebook, it says it cannot give you access. If the email and phone are gone as well as the authenticator, read recovering without the old email, phone or 2FA.

#Mistakes That Close the Remaining Doors

• Logging out of the last signed-in device "to start fresh" before fixing two-factor. That session is your best route back.
• Factory resetting an old phone before checking whether it still runs Instagram or an authenticator app with its own backup.
• Tapping "Deny" on your own login request in a panic, which sends you into a password reset.
• Letting the old number lapse while you wait. A reissued number can end the SMS route for good.
• Recording the video selfie in poor light, in a hat or sunglasses, or with the camera moving.
• Opening a new account to message Instagram, which does nothing for the locked one.
• Following forum tricks that send recovery links through a second account's messages. Use the official screens only.

#Lost Phone or Hacked Account?

A lost factor is your own phone gone. A takeover looks different: an email from [email protected] saying your email was changed, a password you did not set, posts you did not make, or two-factor switched on by someone else. Instagram says that email may let you reverse the change by tapping "secure my account". If that is your situation, our guide to a hacker turning on two-factor is the better starting point. If the takeover also turned your profile into a crypto or investment scam billboard, our guide to Instagram hacked and posting crypto scams covers that version.

#Scams Aimed at People Stuck on the Code Screen

People searching for help with lost codes are an easy target. Offers to "remove 2FA" or "bypass the code" appear in comments, direct messages and Telegram groups, in English, Bahasa Malaysia or Chinese. Some pose as Meta staff. They ask for your password, a login code or a screenshot of your backup codes, then take the account or ask for more money.

• Anyone asking for a backup code, a login code or an OTP is trying to take the account.
• Nobody outside Meta can switch off Instagram's two-factor check, whatever they charge.
• Start every step yourself from the Instagram app or a browser, never from a link someone sent you.
• Legitimate help starts with a case review, uses only Instagram's own processes, works on a best-effort basis, and says plainly that Instagram decides and some accounts do not come back.

If you already paid a scammer, or a code you shared led to a bank or e-wallet loss, the government's NSRC 997 page says to call 997 within 24 hours of discovering the scam, contact your bank and make a police report at the nearest station. A fake login page or phishing link can be reported to CyberSecurity Malaysia's Cyber999, which helps Malaysian users escalate abuse reports.

#Once You Are Back In: A Setup That Survives a Lost Phone

Do this before you close the app. Instagram's authentication app page notes you must be logged in to turn on two-factor, which is exactly the access you just won back.

1. Add an authentication app such as Duo Mobile or Google Authenticator on your new phone. Instagram says this can only be turned on in the Instagram app for Android and iPhone.
2. Connect a second device. Instagram's page on two-factor for multiple devices says you can connect up to five devices to two-factor authentication, each with its own authentication app, and remove one at any time.
3. Get new backup codes and keep them offline: printed and filed, or in a password manager that is not only on your phone.
4. Keep text message codes on as a second method, on a number you will keep. If the number changes, update it on the two-factor phone number page, which shows a fresh list of backup codes when you finish.
5. Check that the email and phone number on the account are current and that only you can open them.
6. Remove the lost phone from Login activity and log it out.

#When a Case Review Makes Sense

Most owners can work through these routes alone, and only Instagram can restore access. A second opinion helps when the identity check keeps failing, when the account carries a business or creator income, or when you cannot tell whether you lost a phone or were hacked. SocialSafe by AwareXone, our recovery service, looks at the case first and tells you honestly whether an official route is still open; sometimes the answer is that you already have what you need. You can see how we approach Instagram account recovery, and our Trust Center sets out what we never ask for, starting with your password and your codes.

#Frequently Asked Questions