Facebook two-factor authentication: set up 2FA and recovery codes
Set up two-factor authentication and account recovery together. Check the authenticator app or phone number, save the backup codes and secure the email account. Then require 2FA for the people working in your Business Manager.
The main guide: Facebook account trust and security.
Protect your own profile
In Facebook settings, open Accounts Center, then Password and security and two-factor authentication. Select the correct profile and complete an available method. Meta provides authenticator-app instructions and an overview of 2FA.
Verify the new method works while you still have an active session and recovery access. Do not start by signing out everywhere before you know where the backup codes will be.
Profile protection and a business requirement are separate
A person’s 2FA protects their login. A business can separately require 2FA for its people. One administrator enabling it personally does not mean the whole team has completed the requirement.
- Check the working profiles with access to important assets.
- Coordinate the business requirement and help people finish setup.
- Make sure the owner retains working access.
- Give additional administrative permissions only to genuine responsible people who need them.
Prepare recovery now
Meta offers recovery codes after 2FA is enabled. Store them securely somewhere you can reach without the one device carrying your authenticator.
| Item | Check |
|---|---|
| Recovery codes | Accessible without the missing device |
| Recovery email | Under your control and protected |
| Phone number, if used | Still active and controlled by you |
| Responsible contacts | Clear ownership of business-access support |
| Team instructions | No personal passwords or codes in shared chats |
A recovery code is a way into the account. An agency does not need it to manage campaigns, nor does a designer need it to upload creative. Use asset roles and partner access for work.
If the phone is already gone
Use your prepared recovery method and Meta’s 2FA troubleshooting for your own account. If you suspect another person signed in, review sessions and access after regaining control.
After setup, check whether the team can keep working if one phone is lost. Recovery access and clear roles matter here.
Related practical guides
- How to verify a Facebook domain with DNS TXT and troubleshoot it
- Business Support Home: check Facebook account restrictions
Over ten years in media buying. I write about ad platforms, account operations and the money behind campaigns. One practical question at a time.
Updated: