What it means
An authenticator app generates short-lived codes for the account's second factor. Instagram backup codes are alternative recovery codes intended for situations such as losing the phone or authenticator. They should be stored securely before a device is lost. A code that anyone can read is an access route; its label does not make it safe to send to a support account.
A real-world example
A phone breaks during a trip. The account password still works, but the app that supplied the second factor was only on that phone. A previously stored backup code may let the owner sign in; a screenshot saved only on the broken phone is no recovery plan.
What to do
Keep unused backup codes in a protected password manager or offline record separate from the phone. Test a new authenticator method before retiring the old device. If someone asks for a code by DM, refuse and report it. Review sessions after any code was exposed.
The distinction that matters
Neither kind of code is a password replacement or an identity document. A backup code may be usable once; a rotating code expires quickly. Both can be abused during a live login if handed to an attacker. Losing access to the recovery email can make the two-factor recovery path harder too, so maintain that mailbox.
Meta two-factor overview Instagram recovery guidance
