Your authenticator app shows a valid-looking 6-digit code, but the site keeps saying the code is wrong.
Why this happens. The app is almost certainly showing a code from an old, stale entry for the same site. Each time two-factor authentication is set up again, scanning the new QR code adds a new entry to the app. The previous entry is not removed automatically, and both entries can appear under the same or a very similar name. Only the newest entry works, but there is no visual way to tell them apart, and old entries keep generating normal-looking codes indefinitely.
How to fix it.
- Open your authenticator app (Google Authenticator, Authy, 1Password, or similar).
- Find every entry for the site, including any that look duplicated.
- Delete all of them.
- Scan the new QR code so exactly one entry exists.
If you already have several entries and are unsure which one is live, delete them all and ask for the two-factor setup to be reissued, then scan once.
Going forward. If your authenticator app lets you label entries, include the date in the name so a stale entry is easy to spot later.