# Lost Your Email, Phone or 2FA? How to Log Back In > Locked out because the email, phone number or 2FA app on your account is gone? What to recover first, and the official route on Instagram, Facebook and TikTok. - URL: https://www.awarexone.com/research/lost-email-phone-2fa-account-recovery - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-09-28 - Topics: Account security, Account recovery, Malaysia - Related service: Social media account recovery: https://www.awarexone.com/all-types-of-social-media-problem-solutions ## Short answer Work from the outside in. Recover the email account through its provider first, because the platform keeps sending resets there. If the number is still yours, get a replacement SIM from your telco. Then try a backup code or a device still logged in. Only after that use the platform's identity check, and never share any codes. ## Summary - Work from the outside in: recover the email account through its provider first, because the platform keeps sending resets there. - If you lost the phone but the number is still yours, ask your telco for a replacement SIM, which at Maxis and CelcomDigi means going in person with your original ID. - Next try a saved backup code, another 2FA method or any device where you are still logged in, before any identity check. - If nothing works, use the platform's own route, such as instagram.com/hacked, facebook.com/login/identify or Need more help on TikTok, and expect to wait. - Never send codes to anyone, and ignore offers to remove 2FA for a fee, because no outsider can switch it off. - The platform makes the final decision and some accounts cannot be recovered, so save new backup codes offline once you are back in. You traded in your old phone, and the authenticator app went with it. The prepaid number on your Instagram lapsed last year. The Yahoo address you signed up with a decade ago now wants a recovery phone you no longer own. Then Instagram logs you out on a Sunday night and asks for a code that has nowhere to go. This lockout is common, and it is often fixable, but the order matters. Recover what you can outside the platform first: the email account through its provider, then the phone number through your telco. Next, use a backup code or a device where you are still logged in. Only after that does the platform's identity check make sense. This guide covers Instagram, Facebook and TikTok, with shorter notes on YouTube and X. It explains why a lost authenticator app is the hardest case, and ends with the setup that stops a phone change from locking you out again. Last checked: 28 September 2026. ## How do you recover a social account without your email, phone or 2FA? Work from the outside in. First recover the email account with its provider (Google, Microsoft or Yahoo), because the platform will keep sending resets there. Next, if you lost the phone but the number is still registered to you, ask your telco for a replacement SIM; at Maxis and CelcomDigi that means going in person with your original ID. Then try a device where you are still logged in, a saved backup code, or another two-factor method you set up. If none of those work, use the platform's own route: instagram.com/hacked, facebook.com/login/identify or facebook.com/hacked, or "Need more help?" on TikTok. Expect an identity check, such as a video selfie or ID, and expect to wait. The platform makes the final decision, and some accounts cannot be recovered. ## What did you lose? Match it to the first fix Each missing piece has a different fix, and fixing them in the wrong order wastes attempts. Find your row, then read the section for your platform. *What you lost, what to recover first, and where each platform sends you* | What you lost | Recover this first | Platform route | | --- | --- | --- | | The email address on the account | The email account itself, through Google, Microsoft or Yahoo recovery | Instagram: log in by phone or Facebook, then change the email. Facebook: facebook.com/login/identify, then "No longer have access to these?". TikTok: phone login, or "Need more help?" | | The phone, but the number is still yours | A replacement SIM from your telco, in person with original ID | SMS codes reach you again, so log in as normal | | The number itself (lapsed, cancelled or recycled) | Nothing: the number cannot be recovered | Use the email, a backup code or a logged-in device, then the identity check | | The authenticator app | Backup or recovery codes, or any device still logged in | Instagram: instagram.com/hacked, lost 2FA option. Facebook: "Need another way to authenticate?". TikTok: "Can't access the app", then a recovery code | | The app and the backup codes | Any other 2FA method you added, or a logged-in device | The platform's identity check: video selfie, ID or friend confirmation | | Email, phone and 2FA together | The email account, if there is any way back into it | The identity check, from a device and network the platform knows. Not always successful | ## Recover the email account before the social account The email account is the master key. Instagram, Facebook and TikTok all send reset links and codes to it, so getting it back often solves the social account too. Instagram is direct about this: its page on [lost email or phone access](https://help.instagram.com/358911864194456/) says it cannot help you get back into your email, and that if you cannot access the email you registered with and did not link Instagram to Facebook, it is unable to give you access to the account. Each email provider runs its own recovery. Start there, not with the social platform: - Gmail: use [Google Account recovery](https://support.google.com/accounts/answer/7682439). Google says wrong guesses do not end the process and there is no limit on attempts. You can find a forgotten Gmail address if you know the recovery phone or email and the full name on the account. - Outlook and Hotmail: try Microsoft's Sign-in Helper first, then the [account recovery form](https://support.microsoft.com/en-us/accounts-billing/manage/help-with-the-microsoft-account-recovery-form). You need a working email for the reply, which can belong to a friend or relative. Microsoft says it replies within 24 hours and lets you try up to twice a day. - Yahoo: use Yahoo's Sign-in Helper, its password reset and account recovery tool, linked from Yahoo's [password help page](https://help.yahoo.com/kb/SLN27051.html). Google's [recovery tips](https://support.google.com/accounts/answer/7299973) apply almost everywhere: use a phone or computer where you usually sign in, the browser you normally use, and a place you usually sign in from, such as home or work. Answer as accurately as you can, and guess rather than skip. For Outlook, Microsoft asks for exact subject lines of recent emails, so ask friends what you last sent them. ## Get your Malaysian phone number back through the telco If you lost the phone but not the number, a replacement SIM brings the number back, and SMS codes start arriving again. At the two telcos below, a physical replacement is done in person, with identity checks. Maxis's [lost or stolen SIM FAQ](https://www.maxis.com.my/en/faq/manage-account/my-account/lost-or-stolen-phone-or-sim/) says to bring your MyKad because it runs biometric verification before replacing a SIM, and that foreigners must walk in with a passport. CelcomDigi's [SIM replacement page](https://help.celcomdigi.com/en/support/solutions/articles/70000666597-how-to-get-a-sim-esim-replacement-) says only the registered account owner can request a physical replacement, in person at a store or kiosk with their NRIC, and that the account must be active with no outstanding bills. Other telcos set their own rules, so check yours before you go. Two conditions decide whether this works. The line has to be registered in your name: at CelcomDigi only the registered owner can ask, and Maxis says business lines need an authorisation letter from the company ([Hotlink by Maxis SIM card FAQ](https://www.hotlink.com.my/en/faq/services/maxis-sim-cards/general/)). And the line has to still exist. When a prepaid line goes inactive, it does not stay yours. Communications Minister Fahmi Fadzil told the Dewan Rakyat in 2023 that under MCMC's numbering plan, inactive numbers go through a six-month quarantine before they are reused by a new subscriber ([The Edge Malaysia](https://theedgemalaysia.com/node/687380)). After that, the new holder receives any SMS sent to your old number, including login codes for accounts you never updated. If your old number has gone, treat it as lost for good. Remove it from every account as soon as you are back in, and move your two-factor method to an app or passkey. > Warning: **Do not ask anyone to forward codes.** Never ask the new holder of your old number, or anyone else, to pass on a login code, and never send your own codes, password or backup codes to someone who says they can help. A code opens the account for whoever types it in. Legitimate support does not need them. ## Try backup codes and logged-in devices before any identity check A backup code, also called a recovery code, is a one-time code the platform gives you when you turn on two-factor authentication, for exactly this situation. It skips the missing app or SMS. A logged-in device is just as useful: a phone, tablet or laptop that is still signed in can approve a new login or let you change your settings. - Look for saved codes: a printout, a password manager, a screenshot on an old phone or in cloud photos, or a note in your email. - Check every device you own, including an old tablet or a work laptop, for a session that is still logged in. - Instagram's [backup codes page](https://help.instagram.com/1006568999411025) says you must be logged in to Instagram to see your codes or get new ones. The path is Accounts Center, then Password and security, then Two-factor authentication, where you choose the account, then Additional methods and Backup codes. So a phone or browser that is still logged in is where to look. - Facebook's page on [login recovery codes](https://www.facebook.com/help/148104135383285) says you can get 10 recovery codes to use when you cannot use your phone, and each works once. ## Instagram: the lost 2FA option at instagram.com/hacked When Instagram asks for a login code you cannot get, look on the code screen for a link to try another way, which lists any other methods on the account. If none work, go to [instagram.com/hacked](https://www.instagram.com/hacked/) in a browser. Instagram built that page as its account access hub: it lets you choose whether you were hacked, forgot your password, lost access to two-factor authentication, or had the account disabled ([Instagram, December 2022](https://about.instagram.com/blog/announcements/continuing-to-keep-instagram-safe-and-secure)). 1. Choose the lost two-factor authentication option and enter your username, email or phone. 2. If Instagram offers it, ask two Instagram friends to confirm your identity. Instagram made this option available to everyone in 2022. 3. If the account has photos of you, Instagram may ask for a video selfie in which you turn your head. Its [video selfie page](https://help.instagram.com/1053588012132894) says you cannot use the account during review, and that if you pass, you may get a reset link at the secure email you gave. 4. Give a secure email address you control now, and watch it for Instagram's reply. If you still have the phone but lost the email, log in with the phone number or through Facebook, then change the email in your profile. Instagram sends a confirm-or-deny request to both the old and new address. Our [Instagram recovery guide for Malaysia](https://www.awarexone.com/research/instagram-recovery-malaysia) covers hacked, disabled and restricted accounts in more depth. ## Facebook: approve from another device, then confirm your identity Facebook's page on [troubleshooting two-factor login](https://www.facebook.com/help/147926301947841) sets out the order. SMS codes can be delayed by your carrier, so wait a few minutes first. Then: 1. Check any browser, phone or tablet where you are still logged in to Facebook. You may see a prompt to approve the new login without a code. 2. Enter one of your saved recovery codes in place of the 2FA code. 3. If neither works, continue to the code screen and use the help link there. On a computer, Facebook lists "Need another way to authenticate?", then "Other Options", then "Get more help". The next step asks you to confirm your identity, which may include a photo of a government-issued ID. If it is the email or phone you lost, Facebook's page on [recovering without your email or phone](https://www.facebook.com/help/132243923516844) suggests trying facebook.com/hacked first, even if you are not sure you were hacked. If that fails, use a device you have logged in on before, such as your own phone, an old phone or a family member's laptop: 1. Go to facebook.com/login/identify in your usual browser and enter any email or phone that might be on the account, with the +60 country code for a Malaysian number. 2. If that does not find it, try your name or username. A friend can copy the username from your profile address. 3. Select "No longer have access to these?" (or "Forgot account?" or "Recover" if that is what you see). 4. Give new contact details. Facebook says they must never have been used on the account before. 5. Complete the checks, then set a new password. Our [Facebook account recovery guide](https://www.awarexone.com/research/facebook-account-recovery-malaysia) covers the ID upload and what to do when Facebook has suspended the account. ## TikTok: another method, a recovery code, or "Need more help?" TikTok's 2-step verification uses at least two methods, chosen from phone, email, authenticator app and password, according to its [account safety page](https://support.tiktok.com/en/safety-hc/account-and-user-safety/account-safety). So losing one method rarely leaves you with nothing. Work through TikTok's options in this order: - Pick the other method when TikTok asks for a code. If you lost the phone, choose email, and the reverse. - Lost the authenticator app: tap "Can't access the app" and enter the recovery code you saved when you set it up. - No recovery code: tap "Need more help?" and complete the form. TikTok says this may take up to 30 days. - Friend verification: from the login screen, tap Help, then Recover your account, find your account, then "Can't access these?" and "Ask friends to verify". TikTok needs at least two friends to respond in time. - Lost the email you signed up with: TikTok's [email and phone help](https://support.tiktok.com/en/log-in-troubleshoot/log-in/email-and-phone-number) also points to "Need more help?" and the form. Our [TikTok recovery guide for Malaysian creators](https://www.awarexone.com/research/tiktok-account-recovery-malaysia) covers bans, restrictions and takeovers. ## YouTube via Google, and X on its own A YouTube channel signs in with a Google Account, so recovering YouTube means recovering Google. Google's page on [2-Step Verification problems](https://support.google.com/accounts/answer/185834) lists what still works if you lost your phone: another phone signed in to the account, another number added in 2-Step Verification, a saved backup code, a security key, or a passkey created on another device. A computer where you ticked "Don't ask again on this computer" may skip the second step. Without any second step, Google says recovery can take 3 to 5 business days while it confirms the account is yours. Our [YouTube recovery page](https://www.awarexone.com/platforms/youtube) covers channel access and brand accounts. X runs its own login and two-factor system. We could not confirm X's current lockout steps from its official help centre when we checked, so we do not list them here. Follow the prompts in the X app, treat any third-party "X recovery" guide with caution, and see our [X account recovery page](https://www.awarexone.com/platforms/x) for how we look at X cases. ## Why a lost authenticator app is the hardest case An authenticator app makes its codes on your phone, from a secret shared once when you set it up. The platform never sends those codes, so it cannot resend them. SMS and email can be recovered because they depend on a number or inbox that someone can reissue to you. An app on a lost phone cannot be reissued by anyone. That is the point of it. A code that only exists on your device is hard for an attacker to steal. It also means that, without a backup, the platform has to fall back on slower checks to be sure it is really you. Microsoft states this plainly: if you turned on two-step verification and cannot use any of the alternate methods, its support agents cannot help you. Meta and TikTok route you to identity checks and forms instead, which take time and may not succeed. ## What the identity check will ask for When the automated routes run out, each platform compares what you give it with what it already holds: the email and phone on file, your usual devices and networks, and the photos and name on the account. Our checklist for [proving you own a social media account](https://www.awarexone.com/research/prove-social-media-account-ownership) sets out what each platform accepts and how to send ID safely. > Warning: **Nobody can switch off your 2FA for a fee.** Anyone offering to "remove 2FA" or "unlock" an account through a contact inside Meta or TikTok is either lying or trying to take the account. Google says it does not work with any account or password recovery service, and no platform sells a fast lane. See how the [fake Meta support scam](https://www.awarexone.com/research/fake-meta-support-scam-malaysia) works in Malaysia. ## Prevent the next lockout: a setup checklist Once you are back in, spend ten minutes on each important account. The aim is that losing any one thing, the phone, the number or the inbox, never locks you out again. - Save new backup codes and store them offline, printed and kept with your important papers. Do not keep the only copy on the phone they protect. - Add a second 2FA method, so the app and SMS are not both on one device with no fallback. - Add a passkey where offered. Meta's [passkey page](https://www.meta.com/help/meta-account/1991801474748071/) says passkeys work on Facebook, Messenger and Instagram but may not be available to everyone yet. Google lists a passkey on another device as a way back in after losing a phone. - Put a current email and phone on every account, and move accounts to a new number before you let an old prepaid line lapse. - Before you sell or trade in a phone, move your authenticator codes to the new one and confirm they work. - Stay logged in on a second device you keep at home, such as a tablet or laptop. - Protect the email account with 2FA and its own backup codes, since it can reset everything else. Our guide to [setting up 2FA on Instagram, Facebook and TikTok](https://www.awarexone.com/research/two-factor-authentication-instagram-facebook-tiktok) walks through each platform's menus and which method to choose. ## When to ask for a case review If you have recovered the email, tried every code and device, and the identity check keeps failing, a second pair of eyes can help. SocialSafe by AwareXone is AwareXone's recovery service. We review your case first, tell you honestly which official routes are left, and help you prepare evidence for the same forms you can use yourself. We never ask for your password or login codes, and the platform alone decides whether the account comes back. Start on the [recovery hub](https://www.awarexone.com/all-types-of-social-media-problem-solutions), and read [how we work](https://www.awarexone.com/trust) if you want the detail. ## Frequently Asked Questions ### Can I recover Instagram if I no longer have the email I signed up with? Sometimes. If you can still log in with your phone number or through Facebook, change the email in your profile. If you cannot log in, recover the email with its provider first. Instagram says that if you cannot access the registered email and never linked Instagram to Facebook, it cannot give you access. That makes the email the first thing to fix, before you try anything on Instagram. ### My prepaid number expired. Can I get it back from the telco? Usually not once it has been reassigned. Under MCMC's numbering plan, inactive numbers are quarantined for six months and then reused. Ask your telco whether the line still exists in your name. If it has gone, recover the account through the email, a backup code or a logged-in device, then remove the old number everywhere. ### The SIM is registered in my parent's or company's name. Can I replace it? Usually not by yourself. CelcomDigi says only the registered account owner can request a physical replacement, present at a store or kiosk with their NRIC. Maxis runs biometric checks on the MyKad, and says business lines need an authorisation letter from the company. So a parent's line needs the parent, and a company line needs the company to authorise it. Other telcos set their own rules, so check with yours. ### Will a new phone with my old SIM fix two-factor authentication? It fixes SMS codes, because they follow the number. It does not bring back an authenticator app, which lives on the old device, not on the SIM. For that you need a backup code, another method you set up, or a device that is still logged in. Otherwise you are into the platform's identity check. ### Where are my backup codes if I never wrote them down? You can only view them from inside the account. If any phone, tablet or browser is still logged in, open the two-factor settings there and get a new set. On Instagram and Facebook this sits in Accounts Center (or Meta Account settings, as Meta moves people over), under Password and security. If no device is logged in, the codes cannot be retrieved from outside. ### How long does TikTok take after I tap "Need more help?" TikTok says the process may take up to 30 days. Submit the form once with accurate, consistent details, then watch the email address you gave. Sending many conflicting requests does not speed things up. If you set up friend verification or have a recovery code, try those first, because they can work much faster. ### Does it help to use my usual phone and home Wi-Fi? Yes. Facebook says its recovery steps work best on a device you have used to log in before, and Google and Microsoft give the same advice for email recovery. Use your normal phone or computer, your usual browser and your home or office connection, and turn off any VPN while you try. ### Someone offered to remove 2FA from my account for a fee. Is it real? No. No outsider can switch off two-factor authentication on an account they do not control, and Google says it does not work with any account or password recovery service. These offers usually end with a stolen payment, a stolen code, or both. Use the official routes, and never share a code with anyone. ### What if every recovery route fails? Some accounts cannot be recovered, and the platform makes that call. Keep your evidence, such as old emails from the platform and screenshots, in case a route opens later. If the account matters to your income or reputation, a case review can confirm whether anything is left to try. Otherwise, start a new account and secure it properly from the first day. ## Official sources - [Instagram Help Center: Lost access to email or phone number linked to Instagram account](https://help.instagram.com/358911864194456/) - [Instagram Help Center: How you can use a backup code on Instagram](https://help.instagram.com/1006568999411025) - [Instagram Help Center: Why you might be asked to upload a video selfie](https://help.instagram.com/1053588012132894) - [Instagram: Continuing to Keep Instagram Safe and Secure (15 December 2022)](https://about.instagram.com/blog/announcements/continuing-to-keep-instagram-safe-and-secure) - [Instagram: hacked account help](https://www.instagram.com/hacked/) - [Facebook Help Center: Troubleshoot login with two-factor authentication](https://www.facebook.com/help/147926301947841) - [Facebook Help Centre: Set up Facebook login recovery codes](https://www.facebook.com/help/148104135383285) - [Facebook Help Center: Recover your account if you can't access your email or phone](https://www.facebook.com/help/132243923516844) - [Meta Help Center: About Meta passkeys](https://www.meta.com/help/meta-account/1991801474748071/) - [TikTok Support: Account safety](https://support.tiktok.com/en/safety-hc/account-and-user-safety/account-safety) - [TikTok Support: Email and phone number](https://support.tiktok.com/en/log-in-troubleshoot/log-in/email-and-phone-number) - [Google Account Help: How to recover your Google Account or Gmail](https://support.google.com/accounts/answer/7682439) - [Google Account Help: Tips to complete account recovery steps](https://support.google.com/accounts/answer/7299973) - [Google Account Help: Fix common issues with 2-Step Verification](https://support.google.com/accounts/answer/185834) - [Microsoft Support: Help with the Microsoft account recovery form](https://support.microsoft.com/en-us/accounts-billing/manage/help-with-the-microsoft-account-recovery-form) - [Yahoo Help: Reset or change your Yahoo password](https://help.yahoo.com/kb/SLN27051.html) - [Maxis: FAQ, Lost or stolen phone or SIM](https://www.maxis.com.my/en/faq/manage-account/my-account/lost-or-stolen-phone-or-sim/) - [Hotlink by Maxis: FAQ, Maxis SIM cards (general)](https://www.hotlink.com.my/en/faq/services/maxis-sim-cards/general/) - [CelcomDigi Help Centre: How to get a SIM/eSIM replacement](https://help.celcomdigi.com/en/support/solutions/articles/70000666597-how-to-get-a-sim-esim-replacement-) - [The Edge Malaysia: Over 70% of active phone numbers on prepaid plans, says Fahmi (2023)](https://theedgemalaysia.com/node/687380) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.