Facebook Protect Locked Account: How to Complete Setup
TL;DR
If Facebook Protect (Advanced Protection) has locked you out, you cannot use the account until two-factor authentication is enrolled. Reset your password from a trusted device, set up an authenticator app, and complete enrollment. If the setup loop fails, request a manual review through the Help Center and escalate under GDPR Article 15 and DSA Article 17.
Facebook Protect, now called Advanced Protection, is a mandatory security program Meta applies to accounts it considers high-risk: journalists, activists, public figures, large Page admins, election officials, and many ordinary users who simply got flagged. When you ignore the enrollment prompt, or fail to finish it, the account is locked until two-factor authentication is correctly set up. The problem: a large share of users get stuck in a loop they cannot exit, especially when the phone number on file is outdated or the authenticator app was never installed.
This guide walks through every realistic path back into the account, what to do when the standard process fails, and how to use European law to force a manual review.
Why Facebook Protect Locks You Out
Meta classifies certain accounts as high-target. Once flagged, you receive an in-app banner and an email from [email protected] giving a deadline to enable Advanced Protection. If the deadline passes, or if you start enrollment but cannot complete it, the account enters a locked state. You can still log in, but every action redirects to the Protect setup screen.
Common reasons enrollment fails:
- The phone number on the account is no longer active, so the SMS code never arrives.
- You enrolled in 2FA via SMS years ago and the device changed.
- The authenticator app prompt loops back without accepting the code, often a clock-sync issue.
- You logged in from a new device or country, triggering an additional security hold on top of the Protect requirement.
- The account was previously hacked, the attacker added their own 2FA, and Meta is now blocking everyone, including the real owner.
Step 1: Confirm the Email Is Real
Before doing anything, verify the prompt is legitimate. Phishing emails imitating Facebook Protect are common. The genuine sender is [email protected]. Real prompts also appear inside the Facebook app and at facebook.com/settings when logged in. Never click links inside an email, type the URL yourself.
Step 2: Complete Enrollment From a Trusted Device
- Open Facebook on a device you have used before, preferably one with an active session.
- Go to Settings, then Accounts Center, then Password and security.
- Find Advanced Protection in the middle of the page. If it shows Off, click it.
- Set a strong new password if asked.
- Choose your two-factor method. An authenticator app (Google Authenticator, Authy, Microsoft Authenticator) is more reliable than SMS.
- Scan the QR code with the app and enter the six-digit code.
- Save the recovery codes Facebook displays. Print them or store them in a password manager.
Once 2FA is active, the Protect lock should clear within minutes. If it does not, log out and log back in.
Step 3: When You Cannot Receive the Code
This is where most people get stuck. If the registered phone number is dead and you never set up an authenticator, the standard recovery loop will not complete on its own.
Try these in order:
- Trusted contacts. If you set them up before, Facebook can deliver recovery codes through them. Available at facebook.com/recover.
- Identity upload. When automated recovery fails, Facebook offers an ID verification path. Upload a government photo ID matching the name on the account.
- Trusted device recognition. Logging in from a device and IP that you have used historically increases the chance Facebook will offer alternative verification.
Step 4: Escalate Through the Help Center
If the loop will not clear, file a manual support request. The most effective form is the Locked Account form at facebook.com/help/contact/260749603972907. Describe the situation in two sentences: that Facebook Protect was triggered, that you cannot complete enrollment because the registered 2FA method is no longer accessible, and that you are requesting manual identity review. Attach a photo ID.
Expect 7 to 21 days for a response. Many users get an automated reply and never hear back, which is when the legal route matters.
Step 5: Use Your Rights Under GDPR and the DSA
Meta operates under EU law and is bound by it for any user resident in the European Economic Area.
Two provisions apply directly:
- GDPR Article 15 gives you the right to access the personal data Meta holds about your account, including the reason for the security flag. A formal Subject Access Request often produces a human response when standard support does not.
- Digital Services Act Article 17 requires Meta to provide a clear statement of reasons for any restriction of an account, and to offer an internal complaint mechanism under Article 20.
Submit a written request to Meta Ireland (the EU controller) citing both articles, request restoration of access, and set a 14-day deadline. The email address is [email protected].
Step 6: When to Use Professional Recovery
If you have followed the steps above and the account is still locked after three weeks, the technical path is exhausted. At that point the choice is to abandon the account or escalate through legal channels.
This is where professional account recovery matters. Recover (operated by Solverae s.r.o. in Prague) uses formal legal arguments under GDPR and the DSA to reach human reviewers inside Meta who do not respond to standard appeals. The service has a 97% success rate and resolves 96% of cases within 30 days. No password required, payment only after the account is restored if you choose the deferred option.
| Method | Realistic Success Rate | Typical Timeline |
|---|---|---|
| Standard Protect enrollment | About 60% if you have the phone number | Minutes |
| ID upload + Help Center form | 15 to 25% | 7 to 21 days |
| GDPR + DSA written request | 30 to 45% | 14 to 30 days |
| Professional recovery | 97% | 2 to 4 weeks |
How to Prevent This Happening Again
Once you regain access, take fifteen minutes to harden the account properly. Read our Facebook security guide for the full checklist. The short version: enable an authenticator app rather than SMS, save the recovery codes offline, add a second email, and review trusted devices monthly. If you also need to recover from a 2FA lockout, the same hygiene applies.
FAQ
Is Facebook Protect mandatory?
Yes, for accounts Meta flags as high-risk. There is no opt-out. Ignoring the deadline causes the account to lock until enrollment is complete.
Can I disable Facebook Protect after enabling it?
If the account remains classified as high-risk, no. You can change the 2FA method but cannot turn Advanced Protection off.
How long does the recovery review take if I upload an ID?
Meta states up to 30 days. In practice, automated responses arrive within 48 hours and human review takes 7 to 21 days. Many cases never receive a substantive reply without legal escalation.