Child Item

Users spoofing our company for cyber fraud

We were contacted by a dropbox sales person (Vicki Shen) stating that we have 89 drop box accounts tied to our companies email domain. We don't use dropbox. I had asked how can I address possible imposters creating dropbox accounts to fraudulently contact others under the disguise of our company's name and she ghosted me. Then I thought I would just contact someone. The only 'one' that you can contact is a bot. How do you get possible cyber crime/fraud investigated through dropbox? The fact that the sales person doesn't think cyber crime is a big deal is the main reason we prohibit employees from using dropbox.

Find more posts tagged with

Security

Disagree

Accepted answers

All comments

Hannah

Thanks for bringing this to our attention, @Trainer232.

Are you positive that this was a Dropbox Sales representative that called you? What did they say on this call exactly?

If you look into your company's email addresses, have any Dropbox emails been received, related to this?

If you can think of any other details that might help us figuring this out, I would appreciate it.

Thanks.

Trainer232

Hi, Yes, positive it was a drop box rep. sales.dropboxbusiness.com It was an email. She scraped a list of our domain names that was being used on dropbox and wants to sell us an admin management console so that we can manage the accounts. Vicki Shen states:

I'm reaching out because our data shows that there are unmanaged users under your domain. Do you need to get control of these users?

- There are currently 84 Dropbox accounts from [Withholding our name].

- In the last 6 months we've seen 9 active users from your business.

- There are currently 163 GBs stored with Dropbox from your team members

Do you have some time Thursday to discuss your account usage and options to keep this data protected?

Best,

Vicki

I stated that we request that our employees don't use dropbox due to security concerns (like this, not being HIPAA compliant, high phishing email references, etc). I requested a list of the 84 account email addresses so that we can verify if any of them are our employees and address the other accounts with Drobbox's cyber security department. She said that the only way she could give me a list of names was to purchase the Admin Console package. I expressed our concerns about cyber fraud and she ghosted me. But... she just replied yesterday so she got wind of my post??? She says that dropbox and references to drop box "have never been linked to cyber criminal activity" which anyone who receives phishing emails knows this isn't correct.

I asked her several times to forward me to someone who can answer questions/help. I realize she is a sales rep and is just spamming people like she is told to do. In my research, I later find out that dropbox doesn't have a cyber security department to address account spoofing and cyber crime being committed using their product. It seems that a company would be able to request a list of everyone using their domain in the account creation process, and, be able to challenge any account that they find may be malicious.

Hannah

Thanks for the update on this, @Trainer232.

Do you perhaps have a reference or ticket number for this communication, so I can investigate further?

Trainer232

It is email communication. Vicki Shen won't put me in contact with anyone to create a ticket and I can't find ANYTHING online from dropbox to talk with someone.Everything goes to a chat bot. No email. No phone number. No support ticket request option. No security contact. Lots of sales contact info though.

Hannah

Thanks for the update, @Trainer232 and happy Monday.

Can I actually send you an email, so we can look a bit further into this?

Trainer232

Yes Please!

Thank You!

Hannah

Not a problem! I've just sent you an email, so we'll continue there.

Cheers!

Bugtown

We have had the same person contact us the same way. None of our departments know her.

Was there an answer to whether or not this Vicki Shen is a real Account Executive?

Trainer2324

No response yet. I've trying to communicate for quite a while. Any support is pretty lean at best.

Walter

Hi @Bugtown & @Trainer2324 - thanks for flagging this with us.

I'd recommend forwarding all the information surrounding your case directly to abuse@dropbox.com

Our team is going to investigate it, and if we find it to be against our Terms of Service or Acceptable Use Policy we will take action on it.

I hope this helps!

Trainer2324

I’m closing this post out. Dropbox has been zero help. They refuse to investigate potential criminal activities on their platform, almost as if they are well aware of it and “a user is a user”. I’ve tried everything I could to get in touch with someone in their security department with no luck. The customer support rep who kept telling me that Dropbox wasn’t going to investigate this issue also refused to put me in touch with someone in their security department. I suspect that this is because there is no security department or any department set to deal with client data security, cybercrime, etc. I’m comfortable with the fact that I have plenty of documentation that they are well aware of the issue with people spoofing our domain and refused to do anything about it. If anyone contacts us stating they have been a victim of cybercrime, we can provide them with what they need for legal action.

(And yes, I know Dropbox is going to delete this thread to cover their tracks.)

Walter

Thanks for sharing your thoughts here @Trainer2324

We can see that our team has already provided all the instructions and info we could at this time via your email correspondence.

Rest assured that if we detect any violation of the Dropbox Acceptable Use Policy, such as phishing, malware, or spam, we will take immediate action. Make sure to contact us at abuse@dropbox.com, as mentioned here on the thread.

Regarding your email/domain safety: It's good to note that most companies, like Dropbox, have email address verification in place to ensure that the right owners have the accounts. However, if you believe that emails were created without your company authorization, we recommend reaching out to your email provider.

Also, if Dropbox detects a suspicious sign-in attempt, we will send a one-time security code to the email address associated with your Dropbox account as an additional security step.

To sum up, for someone to fully use a Dropbox account, they would need to have access to the associated email address.

You can find more information about our security procedures here.