Two factor problem = account lost. user since 2009.

[joaochora]

Good afternoon Dropbox Users and Community,

Today I want to share with everyone my experience with Dropbox for, maybe, Dropbox one day think on it and find a smart solution.. because as I will show you, **it happens!

First of all, I'm writting this text as [removed] (my 2nd account) but the problem is with my main account that I use since 2009 ([removed]).
I´m writting it from this account because I dont have access to my main account.

I'm military and I was in comission out of my country for more or less 1 year and my cell phone carrier cancel my cell phone number because I didn´t pay the monthly value. Of course I knew that will happen but I dont want to pay every month +/- 20€ knowing that I will not use it.. (at this time I was using dropbox without any problem in the desktop).

The time pass and some months after, the Android release the version 7.0 and my system got the update and format the cell phone.

Well I install all of my apps and configure again my bank account because many of them had 2-factor activated. Of course I got some problems in some of them to prove my identity.. (but I sent my id card and mac addresses of the devices that were previous connected to that accounts and all got solve! and we are talking about real money...bank account!).

One of the apps that I reinstall was Dropbox. And I though: "well currently I´m not using it in my cell phone so I configure it later" (again, at this time I was using dropbox without any problem in the desktop)...

The time pass and 1 year after I formatted my computer.

When I was installing all the applications that I had before, I face the problem that I´m sharing with you today... I couldnt access to my Dropbox account because:

Problem 1 - Cell phone number. I no longer have this cell number because it got deactivated.

Reaction 1 - I contacted my old cell phone company and they cant reactivate it because it is beeing sell in some store of the country and they cant know the location of it now.

Problem 2 - I dont have any devices with the dropbox information saved

Reaction 2: But I still have my Sony Xperia Z5 Compact and my desktop that were the last devices to access in my account.

Problem 3 - Unfortunatelly (my mistake) I didnt´t save the emergency pin code correctly... I though the best place should be where I expect never to lose it.. Inside of the dropbox.. So I cant reach it now...

To solve this I have:

Solution 1:
My Dropbox account is connected to my Gmail account.
My Gmail account is connected to my Facebook account and Bank Accounts.
My Gmail account is connected to my Paypal account and eBay account.
Can send you or do a remote connection with Dropbox to prove my identity through logins or send you some data of my bank that had at that time that contacts. this method BUT if it is not enough:

Solution 2:
About my cell phone number I still have extracts of the bank including my personal data . I also have papers with monthly payments to my old number. Can send you to prove my identity too. But even this method isnt enough:

Solution 3:
I still have the devices that were connected in the past to my Dropbox account.
I have the security codes that you sent me to my old number with the codes. I have that messages in my inbox! I also can send you pictures of the mac address and imei of the cell phone or the computer.

Well as you can see I can prove easily my identity if you decide to help a costumer and stop writting me default answers that dont help this situation.

(For the Community I already sent a ticket were I put some information of the solutions that I propose but for now there isnt solution).

For the Dropbox helper that will read this, I know that this is only valid if I write it from the correct email address but as long as I can´t do that, I have this ticket that have many information about this problem.

Ticket: #8172606

I think the solution to this isnt to go through weekly trying to contact my old phone number in the hope that there is already a user to resend me the pin code... This is absurd.

[Jay]

Hi Joao, I removed your emails for security reasons.

Regarding your issue, this is a very common factor when upgrading a phone or having the emergency backup code saved on Dropbox.

The two-step verification scenario you’re experiencing is outlined in my article of the same topic.

Unfortunately, without the emergency backup code, nothing can be done to regain access to your account. 

Using your login with other services to verify your account can’t be used for ownership.

Proof of purchase doesn’t help either, since paying for an account doesn’t constitute ownership of the account. Users pay for other people’s Plus/Professional accounts all the time. Does it mean that they also own that person’s data rightfully?

Previous codes being sent to you as proof are also disregarded, since this is randomized and could still be obtained from a lost phone. If old codes could be used to access your current account, then there’s no point in the security.

I can only reinterate what my article mentioned:

---

… 2FA is special in that you are in control of your own security. Basically, you don’t trust that an email and password alone could secure your account, so you added 2FA. 

For the same reason, we can’t reset your password for you just because you say you own your email address. Otherwise, what’s the point of the extra security?

---

If the agent in the support ticket can’t assist any further, then it’s possible that all options have been exhausted.

Sorry to be the bearer of bad news.

[Mark]

Unfortunately you told Dropbox to not give anybody access to your account unless they had the 2FA details (i.e. the codes you should save when setting it up) or the mobile number. Its only reasonable that they adhere to that instruction and not give anybody access who does not have it. Pictures etc. are easily forged and faked - hence why you need to keep the security codes given.

[joaochora]

Well you are complicating what are so simple,

Lets review Dropbox Policy Privacy:

https://www.dropbox.com/privacy

"Account information. We collect, and associate with your account, the information you provide to us when you do things such as sign up for your account, upgrade to a paid plan, and set up two-factor authentication (like your name, email address, phone number, payment info, and physical address). Some of our Services let you access your accounts and your information via other service providers."

Well can you check if I have a physical address associatted to my dropbox? If I have, maybe you can resent me a code by postal service...

"Contacts. You may choose to give us access to your contacts to make it easy for you to do things like share and collaborate on Your Stuff, send messages, and invite others to use the Services. If you do, we’ll store those contacts on our servers for you to use."

I can provide many contacts of persons that entered in Dropbox through me. Only I know that right? That´s why I got almost 16gb of Dropbox..

"Usage information. We collect information related to how you use the Services, including actions you take in your account (like sharing, editing, viewing, and moving files or folders). We use this information to improve our Services, develop new services and features, and protect Dropbox users. Please refer to our FAQ for more information about how we use this usage information to improve our Services."

I can provide you informations about my folders. Only I know right? And as your terms say: "We use this information to improve our Services, develop new services and features, and protect Dropbox users". So maybe you can use it...

"Device information. We also collect information from and about the devices you use to access the Services. This includes things like IP addresses, the type of browser and device you use, the web page you visited before coming to our sites, and identifiers associated with your devices. Your devices (depending on their settings) may also transmit location information to the Services."

I need to say anything about this? I can provide you cell phone imei / mac addresses anything that you need. And this informations are related to devices that were previous connected in my dropbox account as I can see them in the trusted devices.

Thanks.

[joaochora]

Mark I´m not talking about pictures.
I work in cyber security and I know that are procedures to confirm the identity.. Its not about a picture its about a conversation or bank account details.. Forge this stuff is a crime.

[Mark]

It is a crime. It doesn't stop people doing it though.

Unfortunately though as has been said without the phone or the secure code the accounts none recoverable.

Out of interest have you tried calling the number? If its live would the person maybe give you the number if you got one sent to them?

[joaochora]

It isnt live .. I m waiting for almost 2 years..

[Mark]

Can the cellphone provider not then allocate it to you?

I know that here in the UK you can pretty much request a phone number be allocated to any SIM as long as it isnt allocated.

[joaochora]

Yes here they can't because the numbers are reused..

And as long as he got deactivated they generate another card and sell it.

So Vodafone, can't get me that number because no one knows where the sim card is today..

[Mark]

Oh thats rubbish 😞

Sorry I cant help anymore.