Account Lockouts & Support Failures

As of November 2026, the Better Business Bureau lists 196 complaints against Dropbox, Inc. in the last three years, led by billing (54) and product (54) issues; 182 are marked "Answered" and 14 "Resolved".

Across multiple years, attackers have built convincing fake Dropbox login pages — reached via PDF lures and redirect chains through trusted cloud storage — to harvest victims' real business email and Dropbox credentials.

Dropbox's revised Terms of Service, posted 1 September 2026 and effective 1 January 2027, change the inactivity test for accounts without a Paid Account from 12 consecutive months to 6, raise the minimum age to 18, and say that maintaining an account after the update takes effect means agreeing to the revised Terms. Dropbox's inactive-account help page, updated 31 August 2026, still describes a 12-month test.

As of 4 November 2026, Dropbox is rated 1.3 out of 5 on Trustpilot (1,611 reviews) and 2.7 out of 5 on SmartCustomer, where the old SiteJabber address now redirects (210 reviews, 61% of them one-star).

A consumer law firm opened an investigation into Dropbox Plus auto-renewals in 2025, as strengthened automatic-renewal laws in California and New York raised the bar for consent, reminders, and easy cancellation.

A federal judge compelled the users suing over the 2024 Dropbox Sign breach into individual arbitration — finding that by clicking 'I agree' to sign a document they had accepted Dropbox's terms — and then denied reconsideration, effectively shutting the class action out of court.

Because Dash can be downloaded and set up with 'no sales or IT required,' an individual employee can connect and index an organization's apps and browser history without administrator oversight — recreating the shadow-IT data-governance risk that earlier consumer Dropbox use posed to enterprises.

Dropbox Basic (free) users get no email, chat or phone support — only the help center and community forum. Even paying Plus and Professional customers must first pass through a Dropbox AI assistant before they can reach email or live chat.

Check Point recorded thousands of attacks in which criminals hosted credential-harvesting documents on Dropbox itself, so the phishing emails came genuinely from [email protected] and sailed past filters that trust the Dropbox domain.

Dropbox's Terms of Service require binding individual arbitration and waive your right to join a class action — so even after a breach or billing dispute, most users cannot sue Dropbox or band together in court.

If a user enables two-factor authentication and later loses their authenticator app, backup phone and emergency backup code, Dropbox support has told users it has no process to restore access — and the account, with all its files, is effectively lost.

Users widely report being charged after cancelling, billed on accounts they thought were closed, and unable to get Dropbox support to issue refunds — some taking the dispute to the BBB. The BBB has published a "Pattern of Complaints" alert tied to these complaints.

Dropbox can disable an account for policy violations — and when it does, all access to the account and its files is terminated at once. Users widely report being locked out with little explanation, and that some disablings are triggered by automated abuse-detection.

Dropbox's inactive-account help page (updated 31 August 2026) says Dropbox may close and delete inactive Dropbox Basic accounts, judging inactivity over the past 12 months. Dropbox's revised Terms, effective 1 January 2027, cut the period for accounts without a Paid Account to 6 consecutive months. Dropbox says it will notify users first, and archived copies of the help page show its wording on grace periods and on what counts as activity has changed over time.

Dropbox offers no legacy-contact or memorialization feature. To obtain a deceased person's files, the next of kin must generally produce a court order compelling disclosure — a slow, expensive barrier that leaves grieving families locked out of irreplaceable data.

If a Dropbox account exceeds its (often downgraded) storage quota, users may lose the ability to sync, upload, share, move or even preview files — and if it stays over the limit, Dropbox 'may delete files you own' to force the account back under quota.

When an account exceeds its quota, Dropbox can halt syncing — the core function users depend on — until they delete files or pay more, while the path to downgrade a plan or step back to free is comparatively buried, wrapped in loss warnings, and locked behind non-refundable annual terms.

Dropbox teams must always have at least one admin, but when a sole admin leaves, is offboarded, or loses access, the rest of the team can be locked out of administration — and recovering control or transferring ownership often requires a slow special support process.

Dropbox promises a one-business-day email response on paid plans, but users widely report tickets sitting for days, being marked 'solved' without a fix, or being told to use the volunteer community forum — and some say they turned to the BBB after direct requests went unanswered.

Dropbox sends one-time verification codes for new-device or unusual logins, but when the code goes to an outdated phone number or an inbox the user can no longer reach, legitimate owners report being unable to sign in — and the questionnaire-based recovery often fails.

Four years after the 2012 breach, the stolen credentials surfaced in the wild, forcing Dropbox to reset the passwords of all users who had not changed them since mid-2012.

A persistent class of complaints describes Dropbox files that sit indefinitely in a 'syncing' state and never finish, leaving users unsure whether their data was actually uploaded — in some reported cases for months, with support unable to resolve it.

When the full 2012 credential dump resurfaced in 2016, Dropbox forced a password reset on every user who had signed up before mid-2012 and never changed their password — a sweeping operational response that, for many, was the first sign anything was wrong.

To comply with US trade sanctions and embargoes, Dropbox does not provide service in regions such as Crimea, North Korea, and Syria — meaning users there can be cut off from their existing files by their provider's home-country law.

During the August 2015 global outage, Dropbox's status page reported service restored while many users were still locked out — a documented gap between the company's stated status and the actual experience of its users.