Hey
I received the following email yesterday, sent to the email address used for registering my Dropbox account:
Hi [first name]
[6-digit code] is your one-time Dropbox security code.
Happy Dropboxing!
- The Dropbox Team
However, 2-factor authorization is turned off for my account. I just checked it again, 2FA was, and still is, disabled.
A cursory glance at the source suggests the email was sent by Dropbox. I know sender addresses can be spoofed, but the URL in the email was the real one, so I don't see a reason to believe it's a scam/phishing mail.
My question is then:
Are there any other cases (other than on accounts with 2FA enabled) when Dropbox would send a one-time security code by email?