Account Lockouts & Support Failures

Across multiple years, attackers have built convincing fake Dropbox login pages — reached via PDF lures and redirect chains through trusted cloud storage — to harvest victims' real business email and Dropbox credentials.

A consumer law firm opened an investigation into Dropbox Plus auto-renewals in 2025, as strengthened automatic-renewal laws in California and New York raised the bar for consent, reminders, and easy cancellation.

A federal judge compelled the users suing over the 2024 Dropbox Sign breach into individual arbitration — finding that by clicking 'I agree' to sign a document they had accepted Dropbox's terms — and then denied reconsideration, effectively shutting the class action out of court.

The Better Business Bureau has logged more than 1,180 complaints against Dropbox over three years, dominated by surprise auto-renewal charges, denied refunds, and support tickets that vanish without resolution.

Because Dash can be downloaded and set up with 'no sales or IT required,' an individual employee can connect and index an organization's apps and browser history without administrator oversight — recreating the shadow-IT data-governance risk that earlier consumer Dropbox use posed to enterprises.

Independent review platforms tell a consistent story: a low ~1.9/5 on SiteJabber and a mixed Trustpilot record, dominated by complaints about surprise billing, lost files, and support that never reaches a human.

Dropbox Basic (free) users get no email, chat or phone support — only the help center and community forum. Even paying Plus and Professional customers must first pass through a Dropbox AI assistant before they can reach email or live chat.

Check Point recorded thousands of attacks in which criminals hosted credential-harvesting documents on Dropbox itself, so the phishing emails came genuinely from [email protected] and sailed past filters that trust the Dropbox domain.

Dropbox's Terms of Service require binding individual arbitration and waive your right to join a class action — so even after a breach or billing dispute, most users cannot sue Dropbox or band together in court.

If a user enables two-factor authentication and later loses their authenticator app, backup phone and emergency backup code, Dropbox support has told users it has no process to restore access — and the account, with all its files, is effectively lost.

Users widely report being charged after cancelling, billed on accounts they thought were closed, and unable to get Dropbox support to issue refunds — often resolved only after escalating to the BBB. The BBB has published a pattern alert tied to these complaints.

Dropbox can disable an account for policy violations — and when it does, all access to the account and its files is terminated at once. Users widely report being locked out with little explanation, and that some disablings are triggered by automated abuse-detection.

Dropbox deems a free account inactive after 12 months with no log-in or file activity; the account is then disabled and, after a further period, its files are deleted. Users widely report having data erased while assuming Dropbox was a safe long-term store.

Dropbox offers no legacy-contact or memorialization feature. To obtain a deceased person's files, the next of kin must generally produce a court order compelling disclosure — a slow, expensive barrier that leaves grieving families locked out of irreplaceable data.

If a Dropbox account exceeds its (often downgraded) storage quota, users may lose the ability to sync, upload, share, move or even preview files — and if it stays over the limit, Dropbox 'may delete files you own' to force the account back under quota.

When an account exceeds its quota, Dropbox can halt syncing — the core function users depend on — until they delete files or pay more, while the path to downgrade a plan or step back to free is comparatively buried, wrapped in loss warnings, and locked behind non-refundable annual terms.

Dropbox teams must always have at least one admin, but when a sole admin leaves, is offboarded, or loses access, the rest of the team can be locked out of administration — and recovering control or transferring ownership often requires a slow special support process.

Dropbox promises a one-business-day email response on paid plans, but users widely report tickets sitting for days, being marked 'solved' without a fix, or being told to use the volunteer community forum — with some getting traction only after filing a BBB complaint.

Dropbox sends one-time verification codes for new-device or unusual logins, but when the code goes to an outdated phone number or an inbox the user can no longer reach, legitimate owners report being unable to sign in — and the questionnaire-based recovery often fails.

Four years after the 2012 breach, the stolen credentials surfaced in the wild, forcing Dropbox to reset the passwords of all users who had not changed them since mid-2012.

A persistent class of complaints describes Dropbox files that sit indefinitely in a 'syncing' state and never finish, leaving users unsure whether their data was actually uploaded — in some reported cases for months, with support unable to resolve it.

When the full 2012 credential dump resurfaced in 2016, Dropbox forced a password reset on every user who had signed up before mid-2012 and never changed their password — a sweeping operational response that, for many, was the first sign anything was wrong.

To comply with US trade sanctions and embargoes, Dropbox does not provide service in regions such as Crimea, North Korea, and Syria — meaning users there can be cut off from their existing files by their provider's home-country law.

During the August 2015 global outage, Dropbox's status page reported service restored while many users were still locked out — a documented gap between the company's stated status and the actual experience of its users.