Codes are only demanded from unknown devices, so any laptop, tablet or old handset still signed in, or previously trusted, could be your way in. Otherwise any of these works: a saved backup code, an authenticator on another device, or an SMS code if your number survives on a new SIM. With none of them, it's a phone-based support request and an identity check. After that, sign the lost phone out and save fresh backup codes.
Take stock: what can still vouch for you
Two-factor asks for a code whenever an unfamiliar device tries to sign in. So the real question is less "where's my phone?" than "what else can prove it's me?"
| You still have | Use it like this |
|---|---|
| Another device that's signed in | Fetch backup codes from its settings |
| A device you marked as trusted | Sign in there; no code needed |
| Saved backup codes | Type one where the login code goes |
| Your number on a new SIM | SMS codes follow the number |
| An authenticator app on a second device | Use that device's code |
| None of the above | Support request plus identity check |
Devices that are still signed in or trusted
Run through every place you've ever used Instagram, retired handsets and office computers included.
- Still signed in somewhere? Backup codes are only visible while you're signed in, so open the two-factor settings on that device (additional methods › Backup codes) and store them away from the lost phone.
- Trusted before? If you once chose Trust this device during a two-factor login, Instagram won't ask that device for a code again, so your password alone may do.
Backup codes
Instagram's answer for a lost phone is a backup code, entered in place of the login code. Hunt for them wherever you might have stashed them: screenshots, cloud photos, notes, a password manager, a printout. After using them, generate a new set while signed in; a new set cancels the old one.
SMS, WhatsApp, a second authenticator
- SMS codes go to your number, not the handset. Your carrier can usually put the number on a new SIM, and the codes will follow.
- WhatsApp codes are possible too, but only once SMS has been set up first.
- Authenticator apps (Duo Mobile, Google Authenticator and the like) create codes on the device itself, so they vanish with it. Instagram allows up to five devices per authenticator setup; any extra one you registered now holds your codes.
Nothing left? The support route
- Tap Forgot password? and see whether a login link reaches you.
- Still out? A phone-based support request may be offered; the private inbox you name receives the next steps.
- Prove it's you. Accounts with your photos get a video selfie request, a clip Instagram never shows anyone and deletes within 30 days. Accounts without your photos get questions about the email or number and the device used at sign-up.
Email and number gone as well? No access to email or phone. Suspect the phone was taken to break into the account? Hacked account.
Back in: tidy up
- End the lost phone's session in the session list (full steps).
- Drop it from two-factor as well. Removing a device from two-factor doesn't sign it out, Instagram notes, so do both; trusted devices can be removed there too.
- New password if the phone might be in someone else's hands; every session ends when you change it.
- Fresh backup codes, stored somewhere other than a phone.
Make the next lost phone a non-event
- Keep backup codes off your phone: a password manager, paper, another device.
- Put the authenticator on two devices; Instagram recommends that method and supports up to five.
- Keep your email and number current so links and SMS codes still reach you.
- Trust only your own devices, never public or shared ones, as Instagram advises.
Common questions
How do I get into Instagram after losing my two-factor phone?
Try, in order: a device still signed in or marked as trusted, a saved backup code, an authenticator on another device, an SMS code on a replacement SIM. If none work, request support from a phone and verify your identity.
Where are the backup codes kept?
In the two-factor settings under additional methods, only while you're signed in, which is why they need saving ahead of time.
Can two-factor be disabled while I'm locked out?
No; that switch lives inside the account, so get in first with a backup code or via support.
Is a phone signed out once it's removed from two-factor?
No, says Instagram; end its session separately or change the password.
Locked out by your own two-factor?
Tell us what's left: a second device, codes, the number, or nothing. A free reply picks the route. Passwords and codes stay with you.
Sources
- Securing your Meta Account with two-factor authentication (Instagram Help Center) help.instagram.com
- How you can use a backup code on Instagram (Instagram Help Center) help.instagram.com
- Turn two-factor authentication for multiple devices on or off (Instagram Help Center) help.instagram.com
- Use an authentication app for two-factor authentication on Instagram (Instagram Help Center) help.instagram.com
- If you think your Instagram profile has been hacked (Instagram Help Center) help.instagram.com
- View your recent Instagram login activity (Instagram Help Center) help.instagram.com
- What to do if your Instagram profile posts unauthorized content (Instagram Help Center) help.instagram.com