The checker reads one suspicious email. Batmail reads your whole inbox overnight.
Paste the Dropbox email into the checker and it reads it for the signs below.
The checker reads the sender address, the wording, any link address you paste with the email and what the email asks you to do. It gives a verdict, a risk score from 0 to 100, the exact wording behind each red flag and what to do next. It is free and needs no signup.
Batmail phishing email checker
A fake Dropbox email shares a file from a stranger, asks for your password and sets a short deadline.
Dropbox’s page on phishing lists what phishing emails look like. The email below is invented, and each number is one of the signs.
Example
Hi,
A file called Payroll-Q4 was shared with you by someone you do not know.
Reply with your email and password and we will unlock it for you.
The link expires in 2 hours, so open it now.
The button says dropbox.com/view
The sender's address is not at a Dropbox domain.
Dropbox says official Dropbox websites and emails only appear on or come from its verified Dropbox domains, such as dropbox.com or dropboxmail.com.
A file shared by someone you do not know.
Dropbox lists links to view or download a file from someone you don't know as a sign of phishing, and says not to view or download a file, or accept a shared folder invitation, unless you know the sender.
A request to reply with your email and password.
Dropbox lists emails that ask you to reply with your username or email and password as an example of a phishing attack.
An urgent reason to click.
Dropbox lists emails that mention a current event, entice you with a prize or deal, or claim there's an urgent reason for you to respond or click on a link.
A button that goes to a fake sign-in page.
Dropbox lists links to fake login pages or password reset pages, and says that if you don't trust a link you should go directly to the normal login or home page, for example by typing www.dropbox.com.
From Dropbox Help: How to protect yourself from phishing and viruses, read 9 November 2026.
Read the sender's address from the right, because the last two parts say who owns it.
Anyone can put “Dropbox” in front of an address. The part to read is the domain, after the @ in a sender or after the https:// in a link. Read it from the right: the last two parts name the owner, and everything in front of them is only a label the owner chose. Dropbox names dropbox.com and dropboxmail.com as examples of its verified domains, and the owner of dropboxmail.com is dropboxmail.com.
Read the domain from the right
dropboxmail.com
From DropboxOwned by dropboxmail.com. Dropbox names dropbox.com and dropboxmail.com as examples of its verified domains.
dropbox.com.file-view.example
Not from DropboxOwned by file-view.example. dropbox.com is only a label in front of it.
dropbox-file-notice.example
Not from DropboxOwned by dropbox-file-notice.example. The name has Dropbox in it, but the owner is someone else.
From Dropbox Help: How to protect yourself from phishing and viruses, read 9 November 2026.
Dropbox says official emails come from its verified domains and lists what phishing emails ask for.
Dropbox’s help page gives a list of phishing examples and a rule for files from people you don’t know. A fake file share breaks at least one of them.
| Question | What Dropbox says | What a fake file share does |
|---|---|---|
| Which domains do real emails come from? | What Dropbox saysDropbox says official Dropbox websites and emails only appear on or come from its verified Dropbox domains, such as dropbox.com or dropboxmail.com. | What a fake file share doesComes from a lookalike domain that someone else owns. |
| Will Dropbox ask me to reply with my password? | What Dropbox saysDropbox lists emails that ask you to reply with your username or email and password as a phishing attack. | What a fake file share doesAsks you to reply with your email and password. |
| What about a file from someone I don't know? | What Dropbox saysDropbox says that even if the notification came from Dropbox, you should not view or download a file, or accept a shared folder invitation, unless you know the sender. | What a fake file share doesShares a file called Payroll-Q4 from a stranger. |
| What about a prize, a deal or a rush? | What Dropbox saysDropbox lists emails that mention a current event, entice you with a prize or deal, or claim there's an urgent reason for you to respond or click. | What a fake file share doesSays the link expires in 2 hours. |
| What should I do with a link I don't trust? | What Dropbox saysDropbox says to go directly to the normal login or home page for a service, for example by typing www.dropbox.com instead of clicking a link. | What a fake file share doesSends you to a fake sign-in page. |
From Dropbox Help: How to protect yourself from phishing and viruses, read 9 November 2026.
Dropbox says to read an email's full headers to find out whether it came from a forged address.
Dropbox gives steps for Gmail, Yahoo Mail, Outlook and Apple Mail. In Gmail the steps are short, and Dropbox says to forward the whole email to abuse@dropbox.com once you suspect it.
How to check where a Dropbox email came from
- Show original
In Gmail, More, then Show original.
Dropbox says that while viewing the email you click the More menu in the upper right corner, then Show original.
- Check From
Read the address under From.
Dropbox says to check the email address under From to find out whether it came from a forged address.
- Go to the site yourself
Type www.dropbox.com.
Dropbox says that if you don't trust a link in an email, go directly to the normal login or home page for a service.
From Dropbox Help: How to protect yourself from phishing and viruses, read 9 November 2026.
Five steps tell you whether a Dropbox email is real without clicking anything.
- Leave the button and every link alone. Dropbox says that if you’re not sure who an email is from, you should not click anything in the message.
- Read the sender’s actual address from the right, as in the picture above, and check the headers if you want to be sure it was not forged.
- Check your files by going to dropbox.com yourself. Dropbox says to type www.dropbox.com instead of clicking a link, and the FTC says to contact a company using a phone number or website you know is real, not the information in the email.
- Paste the email into the checker at the top of this page for a second read.
- Forward the complete message to abuse@dropbox.com. In Gmail you can also choose More next to Reply, then Report phishing.
Steps from Dropbox Help: How to protect yourself from phishing and viruses, read 9 November 2026.
Steps from FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 9 November 2026.
Steps from Gmail Help: Avoid & report phishing emails, read 9 November 2026.
If you think someone got into your Dropbox, Dropbox says to change your password and your email password.
Dropbox says that if you suspect an unauthorized person may have accessed your account, you should change your Dropbox password, change the password of the email account you use for Dropbox, remotely log out of any old, duplicate or unknown devices on your security page, and consider setting up two-factor authentication. If an email says your password changed and you didn’t change it, it says not to click any links and to go to dropbox.com instead.
What to do depends on what you did
You only read it.
Forward the complete message to abuse@dropbox.com.
You clicked or typed your password.
Change your Dropbox password and the password of your email account, log out of unknown devices on your security page, and consider two-factor authentication.
You gave other details.
Follow the steps at IdentityTheft.gov for what you shared.
From Dropbox Help: If you get a password or email change notification but didn't reset it yourself, read 9 November 2026.
From Dropbox Help: How to protect yourself from phishing and viruses, read 9 November 2026.
From FTC Consumer Advice: What To Do if You Were Scammed, read 9 November 2026.
From FTC Consumer Advice: How To Recognize and Avoid Phishing Scams, read 9 November 2026.
The same checks work on other file and document emails.
A file notice can borrow the name of any service. The guide to fake Docusign emails covers a document attached to the email, and the guide to fake Microsoft emails covers a sign-in alert. The holiday scam emails guide puts the kinds side by side.
These are the questions people ask next.
How can I tell a real Dropbox email from a fake one?
Dropbox says official Dropbox websites and emails only appear on or come from its verified domains, such as dropbox.com or dropboxmail.com. It says you can view the email's full headers and check the address under From to find out whether it came from a forged address.
What do fake Dropbox emails look like?
Dropbox lists emails that ask you to reply with your username or email and password, that contain links to fake login pages or password reset pages, that contain links to view or download a file from someone you don't know, and that mention a current event, entice you with a prize or deal, or claim there's an urgent reason to respond or click.
What if someone I don't know shares a file with me?
Dropbox says to make sure the email really came from Dropbox, and if it isn't genuine or you're not sure, not to click any links. It says that even if the notification came from Dropbox, you shouldn't view or download a file, or accept a shared folder invitation, unless you know the sender. If you don't know the sender, it says to ignore the notification, delete the email, or decline the invitation.
Where do I report a fake Dropbox email?
Dropbox says to forward the complete message to abuse@dropbox.com. For a suspicious link, it says to send an email to abuse@dropbox.com with a description of how you received the link and the full URL. In Gmail you can also choose More next to Reply, then Report phishing.
What if I get an email saying my password changed?
Dropbox says not to click any links in it. Go to dropbox.com instead and try to log in with your original password. If you can log in, your password was never changed, so ignore the likely fake email and forward it to abuse@dropbox.com. If you can't log in, use the Forgot your password? page, not a link in the email.
What if I think someone got into my Dropbox account?
Dropbox says to change your Dropbox password, change the password of the email account you use for Dropbox, remotely log out of old, duplicate or unknown devices on your security page, and consider setting up two-factor authentication.
Every step on this page comes from these official pages.
Read on . Spot a step that has changed? Email support@batmail.ai and we will fix it.
- Dropbox Help: How to protect yourself from phishing and viruses
- Dropbox Help: If you get a password or email change notification but didn't reset it yourself
- FTC Consumer Advice: What To Do if You Were Scammed
- FTC Consumer Advice: How To Recognize and Avoid Phishing Scams
- IdentityTheft.gov
- Gmail Help: Avoid & report phishing emails