Dropbox scams
Last updated September 19, 2026
The short answer
Dropbox scams use shared-file notifications to get your email password. Some are counterfeit emails; some are real Dropbox links to a document that contains the phishing page. Never sign in to email from a link inside a shared file.
A shared-file notification is one of the most unremarkable emails anyone receives, and Dropbox phishing exploits exactly that. The more effective variant uses real Dropbox infrastructure — a genuine share link to a genuine file — so link scanners see a trusted domain and let it through. The phishing is one layer deeper, inside a PDF that asks you to sign in to view it, which is not a thing any real document does.
How Dropbox scams work
- 1
Counterfeit share notifications
An email imitating Dropbox says a file has been shared. The link goes to a fake Dropbox or Microsoft login page and captures the password.
- 2
Real links, phishing contents
A genuine Dropbox link opens a real PDF or document containing a "sign in to view" button that leads to a credential-capture page. The trusted domain gets the email past filters.
- 3
Compromised contacts
A colleague's Dropbox or email is compromised and the share comes from someone you genuinely work with, sometimes replying inside a real thread.
- 4
Fake storage-full and expiry notices
Messages warning that your account is over quota or that a share expires today, linking to a fake login.
Warning signs
- A shared file you were not expecting, even from someone you know
- A document that asks you to sign in to view it
- The login page domain is not dropbox.com
- The file is named generically — Invoice, Scan, Document, Remittance
- The email urges speed: expiring access, account closing
- The sender address is a personal one for a work matter
- You are asked to enable content or macros to view a document
Examples
The real link with a fake door
A genuine Dropbox notification shares "Q3 Remittance.pdf". The link is real and the file opens. Inside, a blurred page and a "Sign in with Microsoft to view" button lead to a credential page on an unrelated domain. Because the email and the link were both authentic, the mail gateway passed it without comment.
Shared by a real colleague
A compromised account shares a file with fourteen colleagues, replying inside an existing thread. Four sign in. Each of those accounts is then used to share with their own contacts, which is how a single compromise becomes an organisation-wide one within a day.
What to do
- Never sign into email from a link inside a document. No real document requires it.
- Check the domain of any login page before typing a password.
- Verify unexpected shares with the sender on a channel you already use.
- Turn on two-factor authentication on Dropbox and on the email account behind it.
- If you entered credentials, change that password everywhere and check mailbox forwarding rules.
Report it to Dropbox
Forward phishing to abuse@dropbox.com. Dropbox removes files used for phishing and disables the accounts hosting them.
Getting your money back
Change the compromised password immediately and everywhere it was reused, then revoke active sessions and connected apps in both Dropbox and your email provider. Check your mailbox for forwarding rules or filters you did not create — attackers add them to hide replies, and leaving one in place means the compromise continues after the password change. Warn anyone the account shared files with, since the next wave of phishing will come from you. Turn on two-factor authentication on both accounts.
Frequently asked questions
Can a real Dropbox link still be a phishing attack?
Yes, and this is the more effective version. The link and the file are genuine; the phishing is a button inside the document. Because the domain is trusted, security filters let the email through — the defence is the rule that no real document ever asks you to sign in to email to view it.
A colleague shared a file I was not expecting. What should I do?
Ask them on a different channel before opening it. Compromised accounts share to their whole contact list, often replying inside real threads, and a share from someone you genuinely work with is the most convincing version of this attack.
I entered my password on a fake Dropbox page. What now?
Change it immediately, and everywhere else you used it. Revoke active sessions in Dropbox and your email provider, check for mailbox rules you did not create, turn on two-factor, and tell anyone the account may have shared files with.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about Dropbox, these are the guides worth reading next.