Users spoofing our company for cyber fraud

Thanks for bringing this to our attention, Trainer232.

Are you positive that this was a Dropbox Sales representative that called you? What did they say on this call exactly?

If you look into your company's email addresses, have any Dropbox emails been received, related to this?

If you can think of any other details that might help us figuring this out, I would appreciate it.

Thanks.

Hi, Yes, positive it was a drop box rep. sales.dropboxbusiness.com   It was an email. She scraped a list of our domain names that was being used on dropbox and wants to sell us an admin management console so that we can manage the accounts. Vicki Shen states:

I'm reaching out because our data shows that there are unmanaged users under your domain. Do you need to get control of these users?

- There are currently 84 Dropbox accounts from [Withholding our name]. 

- In the last 6 months we've seen 9 active users from your business. 

- There are currently 163 GBs stored with Dropbox from your team members

Do you have some time Thursday to discuss your account usage and options to keep this data protected?

Best,

Vicki

I stated that we request that our employees don't use dropbox due to security concerns (like this, not being HIPAA compliant, high phishing email references, etc). I requested a list of the 84 account email addresses so that we can verify if any of them are our employees and address the other accounts with Drobbox's cyber security department. She said that the only way she could give me a list of names was to purchase the Admin Console package. I expressed our concerns about cyber fraud and she ghosted me. But... she just replied yesterday so she got wind of my post??? She says that dropbox and references to drop box "have never been linked to cyber criminal activity" which anyone who receives phishing emails knows this isn't correct.

I asked her several times to forward me to someone who can answer questions/help. I realize she is a sales rep and is just spamming people like she is told to do. In my research, I later find out that dropbox doesn't have a cyber security department to address account spoofing and cyber crime being committed using their product. It seems that a company would be able to request a list of everyone using their domain in the account creation process, and, be able to challenge any account that they find may be malicious.

Thanks for the update on this, Trainer232.

Do you perhaps have a reference or ticket number for this communication, so I can investigate further?

It is email communication. Vicki Shen won't put me in contact with anyone to create a ticket and I can't find ANYTHING online from dropbox to talk with someone.Everything goes to a chat bot. No email. No phone number. No support ticket request option. No security contact. Lots of sales contact info though.

Thanks for the update, Trainer232 and happy Monday.

Can I actually send you an email, so we can look a bit further into this?

Yes Please!

Thank You!

Not a problem! I've just sent you an email, so we'll continue there.

Cheers!

We have had the same person contact us the same way. None of our departments know her.

Was there an answer to whether or not this Vicki Shen is a real Account Executive?

No response yet. I've trying to communicate for quite a while. Any support is pretty lean at best.

Hi Bugtown & Trainer2324 - thanks for flagging this with us.

I'd recommend forwarding all the information surrounding your case directly to abuse@dropbox.com 

Our team is going to investigate it, and if we find it to be against our Terms of Service or Acceptable Use Policy we will take action on it.

I hope this helps!