Never, ever share your six-digit code with another person. Facebook employees will never ask for this code.
: Unlike SMS-based resets, this endpoint did not properly invalidate the code after multiple failed attempts. This allowed an attacker approximately two hours to brute-force all 1,000,000 possible six-digit combinations (000000 to 999999) to gain entry. facebook six digit code