Account recovery
Apple ID locked after verification code loop: how to get back in
Apple keeps rejecting your verification codes and now the account is locked. Here is why the loop happens and how to escape it without losing the account.
TL;DR
Most "verification code" lockouts come from the wrong code source - SMS to an old number or an autofill grabbing an unrelated code. Pull the code from a trusted device's banner instead of typing it; if you are already locked, start account recovery at iforgot.apple.com.
Why the loop happens
Apple's 2FA flow sends two different things at the same time, and which one you should use depends on what devices you own.
- If you have a trusted Apple device (iPhone, iPad, Mac), Apple pushes a 6-digit verification code as a system notification on every signed-in device. This is the code Apple wants when you sign in on a new device. It appears as a banner with a map showing the approximate sign-in location.
- If you do not have a trusted Apple device, Apple falls back to SMS to a trusted phone number on file. The SMS code is the one to use in that case.
The loop happens when both fire at once and the user uses the wrong one. Specifically: iOS autofill grabs the SMS code and inserts it into the sign-in field. But the field actually wants the device-pushed code, not the SMS one. Apple rejects the SMS code with a generic "incorrect code" error. The user retries, autofill grabs the SMS again, the cycle repeats, and after a few attempts the account auto-locks.
Clock drift is the other major cause - if the trusted device's clock is wrong by more than a few minutes, the time-based codes do not match Apple's server.
First aid before you lock yourself out
If you have just started getting "incorrect code" errors but the account is not locked yet:
1. Stop autofilling. Tap the code from the trusted-device notification manually rather than letting iOS paste an SMS code. The trusted-device code shows in a banner that you can tap "Allow" on, or read off the device-pushed verification screen.
2. Check that the trusted device's clock is set to automatic: Settings -> General -> Date & Time -> Set Automatically. Clock drift breaks 2FA.
3. Make sure cellular data or Wi-Fi is on. The trusted device needs to be online to receive the push.
4. If you cannot find the trusted device push, sign in to icloud.com on another device first; Apple sends the push to any signed-in device, not only iPhones.
5. If your trusted phone number is no longer in service or has been transferred (you got a new SIM with a new number, or your old carrier sold the number), the SMS path is broken until you update the trusted phone on file.
Getting one code right resets the failed-attempt counter.
If you are already locked
Apple auto-locks after several failed verification attempts in a short window. The message reads "Apple ID locked for security reasons" or similar. The recovery path is iforgot.apple.com.
The automated flow:
1. iforgot.apple.com -> enter your Apple ID email. 2. Apple asks you to verify identity via trusted phone number or trusted device push. 3. If verification succeeds, the lock lifts and you set a new password (recommended even if the lock was just from bad codes). 4. If verification fails, Apple offers "Account Recovery" - a slower path that requires a waiting period (24 hours minimum, sometimes several days) while Apple verifies you out-of-band.
Account Recovery is annoying but reliable. Apple emails you when the period ends and walks you through resetting the account. Do not start Account Recovery casually - it locks you out of the account during the waiting period.
If the trusted phone number is no longer accessible to you, Account Recovery is the only path. It is also the path for users without any trusted Apple device.
The Android-only edge case
Users who only have Android devices (typically Apple Music for Android subscribers, or users who use iCloud-on-the-web from Android) hit a specific variant of the loop. Apple sends the verification code to the trusted phone number by SMS - but the sign-in flow on the Android device expects the code to come from a trusted Apple device, which the user does not have.
The fix is to use a path that knows you have no Apple device:
- appleid.apple.com from a desktop browser. The web flow lets you receive the code by SMS as the primary option, not the fallback. The desktop sign-in succeeds; once in, you can manage subscriptions and account settings.
- For the Apple Music for Android app specifically, sign in once at appleid.apple.com from desktop, then restart the Android app. The app sometimes picks up the desktop session without needing its own 2FA attempt.
- Long term, set up a trusted phone number you fully control, and add a recovery contact (someone with an Apple device who can verify on your behalf). Settings -> [your name] -> Sign-In & Security -> Account Recovery.
When to call Apple vs wait
Most lockouts are solvable through iforgot.apple.com without contacting Apple. Skip the support call if:
- You have a trusted phone number you currently control and access to at least one trusted device. - The lock just happened and is from a single short window of bad attempts. - Account Recovery is offering you a reasonable waiting period (24-72 hours).
Call Apple if:
- The trusted phone number is no longer yours and you cannot recover it from your carrier. - iforgot.apple.com refuses to verify you even with correct answers. - Account Recovery is offering you a waiting period longer than 7 days (sometimes Apple does this for accounts with high purchase volume; an agent can sometimes shorten it). - The account has subscriptions or balance that will expire/forfeit during the recovery waiting period.
Apple support route: getsupport.apple.com -> "Apple ID" -> "Can't sign in" -> request a callback.
Related questions
Will my data be deleted while the account is in Account Recovery?
No. Account Recovery is a verification waiting period, not a data wipe. Your iCloud Photos, Mail, Drive, and purchases stay in place. The account is just inaccessible to you (and to anyone else) until the period ends.
How long is the Account Recovery waiting period?
Apple's minimum is 24 hours. The exact length depends on the account state and Apple's assessment of how to verify you. New accounts with little history sometimes wait a few days; accounts with detailed purchase history often clear in 24 hours.
Can I still receive iMessages while my Apple ID is locked?
Yes, on devices that were already signed in before the lock. New sign-ins are blocked. So your iPhone keeps receiving iMessages as long as you do not sign out. Other Apple services on already-signed-in devices generally continue to work.
My trusted phone number is now in another country. Does that affect anything?
If the number still works (still receives SMS), no. Apple sends to the number, not the country. If you have moved and the number was abandoned with your old carrier, you have to update the trusted phone via Account Recovery before SMS-based verification will work again.
Should I set up a recovery contact to prevent this?
Yes. Settings -> [your name] -> Sign-In & Security -> Recovery Contact. Pick someone with an Apple device who can verify on your behalf without going through Account Recovery. It bypasses the multi-day waiting period in most lockout scenarios.
Clear your balance in under a minute.
Free to download. Pay only for the small items you choose inside the App Store.