If SMS/WhatsApp isn’t actually delivering the code, I’d first confirm that the number is still active and linked to the account. If the account offers a security key, that’s another legitimate option, but only if one was previously registered. Otherwise, the recovery flow is probably the better route rather than repeatedly requesting codes.