Facebook 2FA: Where Your Code Should Come From, and Where Sellers Say It Should

Type the six-digit code a moment too late and the next screen is a request to confirm who you are. Nothing about the password was wrong. What changed the outcome was where the code came from and how long it took to get there.

That question has an answer most guides skip, because it is not really about security theory. It is about a habit the account trade has built, and it is measurable.

What Meta actually documents

Two-factor authentication sits in one place. From your profile picture, go to Settings and privacy, then Settings, then Accounts Center, then Password and security, then Two-factor authentication, then pick the account you want to change. Meta lists three methods there in its own words: tapping a security key on a compatible device, using login codes from a third-party authentication app, and using text message codes from your phone.

The company also documents the trigger, and it is narrower than the folklore around it. In Meta's own sentence, when two-factor authentication is on you are asked to enter a login code or confirm the attempt each time someone tries to reach the account from a browser or device it does not recognise. That is the documented rule. Everything else you read about location scoring, session shape and fingerprint history is somebody's theory, including several versions of this page that came before.

One more documented item, and it is the one people wish they had set up afterwards: Facebook issues ten recovery login codes for when you cannot use your phone. They live under Two-factor authentication, Additional methods, Recovery codes, and you have to have two-factor authentication switched on before the option appears at all.

The habit nobody writes about

Here is a thing this site can see and a general guide cannot.

On 1 September 2026 there were 1,344 live Facebook account listings on this marketplace from 88 sellers, counted under the storefront's own visibility rules. Two hundred and thirty-five of them, one in six, carry a two-factor code-generator website in their own delivery instructions. Not as a footnote: as the step. The text says things like "to retrieve 2FA codes, visit" and then a URL, or "paste your provided 2FA secret key to get your login code."

Folding each of those URLs down to its hostname, one site accounts for 157 of them, a second for 37 and a third for 23, with four more sites named a handful of times each. Google agrees about which one dominates: the first completion for the phrase "facebook 2fa" on the same day was that same site's name.

The concentration matters as much as the count, so it is worth stating plainly. Those 235 listings come from 11 of the 88 sellers, and a single seller accounts for 140 of them. This is the house style of a few large sellers rather than something the shelf does. Most sellers hand over a key and say nothing about what to do with it.

Why a website is a different thing from an app

The six-digit code is derived from a secret key using a time-based standard, so the key is the account and the code is just the current second's answer. Three consequences follow, and none of them depends on any claim about a particular website.

• The secret does not expire. Pasting it into a page once is not a one-time exposure. Whoever holds that string can produce a valid code for as long as the second factor stays as it is.
• You cannot see what a page does with what you paste. A generator that computes the code in your browser and one that posts your key to a server look identical from the outside. That is not an accusation about any named site; it is why the question cannot be settled by looking.
• Changing the password does not touch it. The password and the second factor are separate credentials. Meta's own article on changing a password says nothing about sessions or about the second factor, and a side effect that is not documented is not a plan.

So the fix is small and it is the same in every case. The first time you have working access, add the key to an authenticator app you control, then remove the existing two-factor method and set it up again so a new secret is issued, then generate a fresh set of recovery codes. That last step is what turns a key somebody else once held into one only you hold. For how a secret becomes a code, and what our own generator does with the string you type into it, see the TOTP generator guide.

A listing saying 2FA is not a listing giving you the key

These are two different claims and the shelf treats them as one. Of those 1,344 live Facebook listings, 977 mention two-factor authentication in some form, which is a little under three quarters of the shelf. Twelve of the 977 are saying the account has none, and another six hedge with wording like "2FA possible" or "key if available", which is worth reading carefully rather than skimming.

Searching the same text for an actual key, secret, one-time-password value or TOTP string finds 352. That leaves 625 listings that advertise the feature without saying you receive the thing that generates the codes.

The difference decides whether you can log in twice. If the second factor is attached to somebody else's phone or app and no key comes with it, the first login prompt is where the purchase ends. Ask before you pay, in writing, and ask for the plain key rather than a link to a page that generates codes for you, because the key is what lets you move the account into your own tooling.

The first sign-in, without the folklore

What is defensible here is short, so here is the short version.

1. Have the second factor open before you start. Codes rotate every thirty seconds. Fumbling for the source after the prompt appears is the avoidable half of a slow login.
2. Use one browser profile and stay in it. Meta's documented trigger is an unrecognised browser or device, so the fewer of those you introduce, the fewer prompts you meet.
3. Have the recovery material to hand. A mailbox you can open, a phone number that reaches you, and recovery codes if the account already has them. This is the material a checkpoint asks for, and hunting for it while the screen waits is how people end up locked out.
4. If a check appears, stop. Repeating the attempt from different networks adds unrecognised devices to an account that has just asked whether it recognises you. Wait, then try again from the same place.
5. Leave credential changes for later. Doing them in the same minutes as a first login stacks two sensitive actions on an account that has no history with you. The order that works is in changing a Facebook email and password without locking yourself out.

If you would rather read Meta's own account of the recovery routes when an authenticator device is gone for good, the two-factor authentication help article is the page that documents them.

Buying an account that already has 2FA

Plenty of buyers take over accounts rather than registering and warming their own, and on this shelf most listings say two-factor authentication is already on. Five things are worth settling before payment rather than after.

• Ask whether the key arrives as a plain secret you can add to your own authenticator, not only as a link to a code page.
• Ask what mailbox or phone number is attached and whether you get access to it, because that is what a checkpoint will ask for.
• Read the wording for hedges. Six listings on this shelf say the key comes only if it exists, and that is a real condition rather than sales language.
• Check recent reviews for the individual seller rather than the site average, since delivery format varies far more between sellers than between shelves.
• Confirm what the after-sales terms cover if the account asks for a verification you cannot pass in the first hours.

The shelf itself is at Facebook accounts, and the growth side is at Facebook services. For the screens to work through once you are in, the Facebook account security checklist covers passkeys, recovery codes and the session list, all of which changed location when Meta moved these settings.