Short answer. Instagram account disabled 2FA covers two stuck points: a two-factor code you cannot get, and a disable notice behind that loop. Try backup codes and a device you have used before. If the screen says disabled, screenshot it and appeal. Never send a 2FA code to anyone.
Instagram account disabled 2FA is the search when a two-factor prompt and a ban show up together, or when the code wall feels like a ban. Split them.
If you still have backup codes, use one, on a device you have used before. If the authenticator app or the SMS number was swapped, treat it as a takeover. Secure the email and follow Instagram hacked email changed. If you cannot reach the email or the phone at all, use Lost access to email and phone on Instagram. A lock screen that only wants a confirmation is Instagram account locked.
Do not forward the six-digit code. That code logs someone else in. We never ask for it.
If the next screen says the account is disabled or suspended, screenshot it and appeal. A password reset does not clear that notice. The path is Instagram account disabled: how to get it back. When you are back in, turn two-factor on again with codes stored offline, not in a chat.
Send the username and the screenshot of whichever screen you are stuck on. We file disable appeals through Meta’s own official channels. It takes a few days. Start a case on the contact page. How it works is the three steps. We never ask for your password.
Use a backup code if you saved one. A lost phone is [Instagram 2FA locked out, lost phone](/guides/instagram-2fa-lost-phone). If a hacker turned the check on, that is [hacker turned on 2FA](/guides/hacker-enabled-2fa). If the code app or phone number was changed, treat it as a hack and follow the hacked-account steps on a device you trust.
The account says disabled after I fail 2FA.
Screenshot the disable notice and appeal from its button. A code loop alone does not clear a disable.
Can I turn 2FA off by emailing you the code?
No. We never ask for a 2FA code or the password. Codes stay on your device.
What should I send?
The username, a screenshot of the 2FA screen or the disable notice, and the email you can still open.