Facebook Checkpoint Required: How to Verify and Unlock

TL;DR

A Facebook checkpoint is a security wall that locks your account until you prove who you are. Complete every prompt in one clean session using a clear ID or selfie, your usual device, and no VPN. If the checkpoint loops or rejects your submission, an appeal grounded in GDPR and DSA rights is usually the fastest path back.

You log in and instead of your feed you see a full-screen message: "We need to confirm it's you." No skip button. No support chat. Just a checkpoint standing between you and your account. This is one of the most common lockouts on Facebook, and it can affect brand-new profiles, ten-year-old accounts, and business Pages alike.

This guide explains what a Facebook checkpoint actually is, why it fires, exactly how to clear each type, and what to do when the checkpoint refuses to release you. If you already know the checkpoint won't accept your submission, jump straight to the section on stuck checkpoints and legal escalation.

What a Facebook Checkpoint Really Is

A checkpoint is Meta's automated risk system placing a temporary hold on your account. It is not a ban and it is not a disable. The account still exists, your data is intact, and your friends and followers are untouched. The system has simply flagged something it wants a human, or an automated identity check, to verify before letting you back in.

Checkpoints exist because Meta processes billions of logins a day and needs a way to stop takeovers, spam waves, and impersonation without manually reviewing every login. The trade-off is that legitimate users get caught in the net constantly, especially when they travel, buy a new phone, or reset a password.

Why Facebook Triggered a Checkpoint on Your Account

Meta does not publish the exact rules, but recovery data across thousands of cases points to a consistent set of triggers. If any of these apply to you in the last few days, you now know why the checkpoint fired:

New location or new device. Logging in from a different country, a new laptop, or a phone you have never used before. VPNs and proxies count as new locations and are one of the top triggers.
Password reset or 2FA change. Any change to your login credentials starts a cool-down where Facebook re-verifies the account. If you're stuck on the 2FA screen instead, see our guide to recovering a Facebook account after a 2FA lockout.
Suspicious login pattern. Many failed attempts, rapid country hops, or a login right after a data breach dump involving your email.
Reports from other users. Even a small number of impersonation or fake-account reports can push your profile into review. Read more in our impersonation dispute guide.
Rapid activity spikes. Sending many friend requests, joining lots of groups, or posting at high volume in a short window.
Underage flag. An automated system decided your account belongs to someone under 13. This is common with young-looking profile photos.
Business or ad-related risk signals. Running ads with new payment methods or logging into Business Manager from a new location. For ads-specific issues see our Facebook Ads account appeal guide.

The Four Checkpoint Types You Might See

Not every checkpoint asks for the same thing. Knowing which type you're facing changes the strategy.

1. Confirmation Code Checkpoint

Facebook sends a 6-digit code to the phone number or email on file. This is the easiest checkpoint to clear, assuming you still control the phone or inbox. If the number is outdated, tap "I no longer have access to these" and Facebook will offer alternative options, usually an ID upload.

2. Photo of Yourself (Selfie) Checkpoint

The screen asks for a "photo of yourself" that Facebook will run against your uploaded profile pictures using facial recognition. Take the photo in bright, natural light. Face the camera directly. No sunglasses, no filters, no hats. The system compares your selfie to public photos of you on the account, so if your profile only has landscapes or old photos of someone else, this check will fail.

3. Government ID Checkpoint

The most serious checkpoint. Facebook asks for a scan or photo of a passport, national ID card, or driver's license. Requirements: your legal name must match the name on the account, the photo must be sharp and well-lit, all four corners visible, and no glare covering any text. You can upload up to three IDs to strengthen your case. Meta claims the ID is deleted within 30 days after review.

4. Trusted Contact or Security Question Checkpoint

Rare today but still deployed for very old accounts. Facebook asks you to identify friends in photos or contact people you previously listed as trusted contacts. If you set up trusted contacts years ago and no longer speak to those people, this checkpoint is often unsolvable through self-service.

Step-by-Step: How to Complete Your Checkpoint Correctly

Prepare before you start. Have your ID or a good selfie ready, sit in a well-lit room, and use the phone or laptop you normally log in from. Turn off any VPN or proxy. Close other tabs.
Go to facebook.com in a fresh browser session. Log in with your usual email and password. The checkpoint should appear immediately. Do not use the mobile app if the browser flow keeps failing, and vice versa. Try both.
Read the exact prompt. Note whether it's asking for a code, a selfie, or an ID. Do not submit an ID when it's only asking for a selfie. Extra information can slow the review or introduce a name mismatch.
Submit a clean file. For ID: JPEG or PNG, under 8MB, all edges visible, no fingers over text, no glare. For selfie: neutral expression, full face, plain background, natural light. For codes: enter the code within 10 minutes of receiving it. Old codes expire silently.
Do not submit twice. If the page hangs after upload, wait an hour. Repeated uploads can push you into a "too many attempts" state that adds days to the queue.
Wait the standard window. Facebook typically clears the checkpoint within 48 hours for codes and selfies, and 3–5 days for ID reviews. During busy periods this can stretch to 30 days.

When the Checkpoint Won't Release You

If you have completed the checkpoint correctly and it still won't clear, you are in the "verification loop": a state where every submission is silently rejected. Common reasons the loop happens even with a perfect submission:

Your account name doesn't match your legal ID. Facebook is strict about this. A childhood nickname or married-name mismatch is enough to fail the check indefinitely. Our real name policy suspension guide covers this specific scenario.
You never uploaded profile pictures of yourself. The selfie compare has nothing to match against.
The account was already flagged for another reason before the checkpoint fired, and Meta is waiting on the other review first.
You changed your legal name recently and haven't updated it on your Facebook profile.
Your ID is issued by a country whose documents Meta's system doesn't recognize well.

At this point the standard checkpoint flow is exhausted. The only remaining paths are the general appeal form (low success rate) or a legal escalation.

Your Legal Rights: GDPR and the Digital Services Act

If you're an EU resident, you have enforceable rights that override Facebook's automated checkpoint system.

Under GDPR Article 15, you have the right to access the personal data Meta holds about you, including the data used to trigger the checkpoint. Under Article 22, you have the right not to be subject to a decision based solely on automated processing that produces significant effects on you, and you can demand human review.

The Digital Services Act (Article 20), in force across the EU since 2024, requires very large platforms like Facebook to provide access to an internal complaint-handling system for at least six months after any restriction. Article 21 gives you the right to escalate to a certified out-of-court dispute settlement body if the platform's own review fails.

These frameworks are what turn "please review my account" into a formal legal demand Meta cannot ignore. A properly drafted request cites the specific articles, references your account, and gives a deadline for response.

When Professional Recovery Makes Sense

Self-service works for most simple checkpoints. If you're inside the first 48 hours and you have a clean ID and a matching name, submit the form yourself and wait.

Professional recovery is worth considering when:

You've completed the checkpoint two or more times with no response.
Your ID name doesn't match the account and you can't easily change either.
Your account is a business Page, ads account, or Business Manager and downtime is costing revenue.
You're outside the 30-day window since the checkpoint appeared.

Recover, operated by Solverae s.r.o. in Prague, resolves 97% of cases and closes 96% within 30 days. The recovery method uses legal arguments under GDPR, DSA, and platform terms of service to reach real human reviewers inside Meta, not the automated appeal queue. No account password is required. If recovery fails, the fee is fully refunded. Personal profiles are €290, business profiles €690, and there's a pay-after-recovery option with a €19 deposit if you prefer to only pay after the account is restored.

The most expensive mistake with a checkpoint is submitting a poor-quality ID five times, hitting a hard block, and only then looking for help. Give it one clean attempt, wait the full 48 hours, and if nothing changes, move to escalation before Meta closes the case entirely.

Prevention: Reduce Future Checkpoints

Once you're back in, these habits significantly cut the odds of another lockout. Enable two-factor authentication using an authenticator app, not just SMS. Keep at least one verified profile picture of your actual face. Match your Facebook name to your government ID. Avoid logging in through VPNs unless necessary, and if you must, use the same VPN server consistently. Add trusted contacts and keep them updated. Review the full Facebook security guide for the complete hardening checklist.

Frequently Asked Questions

How long does a Facebook checkpoint usually take to clear?

Confirmation codes clear instantly. Selfie checkpoints typically resolve within 24–48 hours. ID reviews take 3–5 business days in normal periods and up to 30 days during busy queues. If nothing has changed after two weeks, the case is almost certainly stuck in a loop and needs escalation.

Can I skip the Facebook checkpoint and just make a new account?

Technically yes, but Meta's systems will link the new account to your device, IP, and network and often block it within days. Any data, followers, Pages, and ads history on the old account are also lost. Recovering the original account is almost always the better option.

Is uploading my ID to Facebook safe?

Meta states that identity documents are encrypted and deleted within 30 days of the review being completed. In practice this policy has held up in EU regulatory audits. If you're uncomfortable, you can cover the document number (leaving name, photo, and date of birth visible), though this occasionally results in a rejection.