Need to see if your shared folder is taking up space on your dropbox đŸ‘šâ€đŸ’»? Find out how to check here.

Forum Discussion

radenkovic's avatar
radenkovic
Helpful | Level 5
3 years ago

Received 3 2FA emails in one minute, but 2FA was not enabled on my account

Hi all,   A strange thing happened today, I've received 3 emails  in sequence with content:       Hi [MY FIRST NAME], Finish signing in to Dropbox with this one-time security code...
account access
security
willywonka's avatar
willywonka
Helpful | Level 5
3 years ago

Hi Jay , does it mean someone typed my email in dropbox, and then typed the incorrect password?
Or is there any other scenario in which that one time code could be triggered?

 

 

Jay's avatar
Jay
Icon for Dropbox Community Moderator rankDropbox Community Moderator
3 years ago

That's correct, though aside from this, there are other items that Dropbox uses to detect a suspicious login attempt.

  • Randy90's avatar
    Randy90
    Helpful | Level 5
    3 years ago
    So they have “methods” to detect suspicious activity but apparently me trying to login using a VPN from a location I haven’t ever been before isn’t “suspicious” enough to trigger an OTP email?

    I’m not buying it, if I had initially received just a single email then I’d most likely ignore it, perhaps change my password but nothing to get worked up about.

    But that fact that me and MANY others received not 1, not 2 but THREE consecutive emails with OTP’s in the span of a minute is insanely (as you’d put it) “suspicious”.

    We want answers and transparency, this was not someone trying to login using just the email on the off-chance because I’ve already attempted to replicate that, I didn’t receive a single email no matter how many times I tried it or wherever I moved the VPN to.
  • MENTZC's avatar
    MENTZC
    Helpful | Level 5
    3 years ago
    Randy90 wrote:
    We want answers and transparency, this was not someone trying to login using just the email on the off-chance because I’ve already attempted to replicate that, I didn’t receive a single email no matter how many times I tried it or wherever I moved the VPN to.

    Yeah I tried as well from a VM created in another country from where I am. The front end doesn't trigger it with an invalid password. Maybe one of the API endpoints does but it is not worth my time to setup a developer account just to test this. 

     

    At this point I am just going to delete my account. Even if my account wasn't compromised, and somehow believe the "Just ignore this" email we got 3 times in a row is just their internal system sending emails in error, I just can't trust them anymore.  For all we know they had an internal breach, and they just haven't disclosed it yet. 

  • willywonka's avatar
    willywonka
    Helpful | Level 5
    3 years ago

    I also believe there can be a leak, that they decided to not disclose in order to protect their reputation.

    I also decided to delete all my files from dropbox given the lack of transparency in the topic.

About Security and Permissions

Start a discussion in the Dropbox Community forum to get help with your account security and permissions. Find support from Community members.

The Dropbox Community team is active from Monday to Friday. We try to respond to you as soon as we can, usually within 2 hours.

If you need more help you can view your support options (expected response time for an email or ticket is 24 hours), or contact us on X, Facebook or Instagram.

For more info on available support options for your Dropbox plan, see this article.

If you found the answer to your question in this Community thread, please 'like' the post to say thanks and to let us know it was useful!