[security] Got a Dropbox security code email, but 2-factor verification is *off*. Reasons?

[bertzander]

Hey

I received the following email yesterday, sent to the email address used for registering my Dropbox account:

Hi [first name]

[6-digit code] is your one-time Dropbox security code.

Happy Dropboxing!
- The Dropbox Team

However, 2-factor authorization is turned off for my account. I just checked it again, 2FA was, and still is, disabled.

A cursory glance at the source suggests the email was sent by Dropbox. I know sender addresses can be spoofed, but the URL in the email was the real one, so I don't see a reason to believe it's a scam/phishing mail.

My question is then:

Are there any other cases (other than on accounts with 2FA enabled) when Dropbox would send a one-time security code by email?

[Mark]

I'd suggest sending it in to the team: www.dropbox.com/support and asking them as its an account specific request.

You can then track at http://dropbox.zendesk.com

[frankmu]

Exact same situation happend to me yesterday. Did you get a reply from Dropbox? Is this part of a large scale attack?

[Jane]

Hey frankmu, as this is an account-specific matter, I’ve made sure to run a search on our system on my end, I’ve located your open support request & I’ve made sure to reply to you there asking some details, in order to determine what’s happening together. 

Whenever you find some time, please check your inbox our latest email & let me know here in case you’re unable to locate this reply. 

Hopefully this is helpful to you & I’ll be awaiting your next reply on that email chain. Until we talk again, have a great rest of your day! 

[artaxerxes]

Yeah me too. I’ve had 5+ in the last few hours

[Mark]

Five sounds extreme!

Make sure you log it as a ticket 🙂

[mcreardon7]

why am I seeing multiple one-time security code emails? I recieved 5 last night.

I dont have 2FA on

[Jane]

Hey artaxerxes & mcreardon7, thanks for your reports! 

In order to gather all relevant details & further assist you on the matter, I’ve made sure to reach out to you directly via email on my end, so please have a look at your inbox whenever you get a chance & I’ll make sure to promptly follow-up with you asap. 

I hope that this is helpful to you & I’m looking forward to hearing back from you via email! 

[Jdzaffuto]

I just got that same email too at 5:55am while I was sleeping. Freaked me out. I changed my password and enabled 2FA. Looked it up to find others having the same issue. Someone is doing something.

[Jane · Accepted solution]

Hi again to all, I have some more info to share with you on your security-related inquiry that will shed some light on why you received this email from us. 

I can confirm that the email that you have received is a legitimate email from Dropbox. You were sent this message because you have recently attempted to log in to your account. You will need to enter this verification code to complete the sign in process.

We have implemented this to prevent abuse on your account. If you continue to receive these emails and you are not attempting to log in, we would recommend changing the email address connected to your account and securing your account by doing the following:

#1. If you haven't done so already, you can change your Dropbox account password, which you can do by clicking this link & following the on-screen prompts.

(Note: Dropbox recommends strong passwords that are not used for any other website or service. Once you change your password, the change will become effective immediately on all computers and devices linked to your account.)

#2. For added security, we recommend that you enable two-step verification, which protects your account even if your password is compromised. Once enabled, Dropbox will require a six-digit code in addition to your password when signing in to the Dropbox website or linking a new device. 

When it comes to the open ticket you had submitted Jdzaffuto, I’ve located your open support request on our system & I’ve made sure to reply to you there. Whenever you find some time, please check your inbox for my latest email & let me know here in case you’re unable to locate this reply. 

Of course, if any of you is having trouble logging in or if you have any further questions, please let me know here & I’ll make sure to reach out on my end to anyone having additional questions or concerns!

[Mod edit 2023, edited Help Center link]