My colleague says I requested access to a folder but I didn't - how did this happen?

Hi there, ma-chong, thanks for joining our Community!

Let's get right to it.

So, this request means that you tried to access the shared folder (probably from the invitation email), while logged in to a Dropbox account that doesn't have access to the folder.

You'll get a screen that says that you're signed in to an account that doesn't have access and you'll see a button which you can press to request access.

I hope this makes sense, but does that sound like something you might have done?

Let me know.

Hi Hannah,

Thank you for your kind reply.

Actually, I was not aware of the existence of that shared folder and I definitely did not try to access it myself.
Does this mean that my account might have been compromised and someone else performed this action instead of me?

Is there any way to check from which IP address or device, and at what time, my Dropbox account was accessed?
I just created my Dropbox account last week and have logged in only 2–3 times from a single device.

Hmm, would you mind sending us a screenshot of this request? I'm assuming it was an email, right?

Just make sure to hide your email address or any other personal info before sending it.

Yes, my colleague has forwarded the request email (written in Japanese) to me. Kindly find the attached screenshot. Except for this email, I have not received any other emails concerning this shared folder.

Hey ma-chong! Hope you don’t mind if I jump in. 

From the email you received, I get that your colleague is part of a Dropbox team and you sent them a request to join said team (by requesting to be a member of their folder). Please let me know in case I’ve misunderstood something, though.

As for checking the IP addresses of any device that’s accessed your Dropbox account, you can see a list at your Security page here. 

If you find anything that looks odd there, you can follow these steps to secure your Dropbox account.

Hi Nancy,

Thank you for your kind reply.
Yes, my colleague is part of the Dropbox team. However, the thing is that I did not send any request to join the said team. I wasn’t even aware that my colleague was using Dropbox or that the shared folder existed.

Thanks for updating me, ma-chong! Did you also check the page I sent you above? 

Do you see any unfamiliar browsers or devices connected to your Dropbox account there?

Yes, I did find some unfamiliar IP addresses, though I’m not entirely sure whether they were caused by the use of a VPN. I have reset my password to a new and stronger one, and enabled two-factor authentication. I hope this will help keep my account secure.

By the way, is it possible to force-log out all Dropbox sessions on every device, and require re-login using the new password?

Another thing I’m wondering is that when I log in to Dropbox from a new device, I usually receive an email notification. However, for the unfamiliar IP login, I didn’t receive any such email. Also, regarding the shared-folder access request, aside from the email forwarded by my colleague, I didn’t receive any notification from Dropbox. I also couldn’t find any record of this request in my Dropbox account settings.

HI ma-chong, you can delete all sessions from the devices page, aside from the active session (which is the one you're currently using to access that exact page), to log out all other browsers and devices. Users will then need to use the new password to log back into the account.

For the shared folder access request, it should appear in the activity page (the bell icon) on your account, which can be seen on the left on the home page.

Hi Jay,

Thank you for your kind advice.
To prevent any possible security issues, I have logged out from all devices once.
Regarding the shared folder access request, I checked the activity log, but it seems there is no record of any such request. All of the record is shown bellow.