Parent Notice, Attachments and a Suspicious Result Link
An HSLC class representative must send the practical exam schedule to 40 parents. The schedule is a 12 MB PDF. The representative's free webmail account allows attachments up to 10 MB per message and 100 MB total mailbox storage, with 92 MB already used. The school has a cloud drive that parents can access through a link, but the representative has never used it. That evening, the representative receives an email with the subject 'ASSEB HSLC Result 2025 - verify now'. The sender address is [email protected], the school name is misspelt in the body, and the message asks the student to click a link and enter the roll number, date of birth and the OTP sent to the parent's phone. It says the result will be 'locked in 30 minutes'. The representative is anxious and wants to forward it to all parents so they are not late.
1. List at least four signs that the result email is a phishing attempt, and state the safest sequence of actions.
Read the worked answer
Signs include: the domain mail-secure-check.example is not the official board domain; the sender name uses a lookalike spelling; the school name is misspelt; the message creates false urgency with a 30-minute lock; it asks for an OTP, which legitimate result portals do not request; and it uses an unsolicited link rather than directing users to type the official address. Safest sequence: do not click the link and do not forward the message. Report it to the school and to the appropriate cybercrime reporting channel. Verify the result only by typing the official website address manually. If the link was already clicked or details entered, change the portal password immediately, tell the parent, and watch for unauthorised login attempts. Warn parents through the school's verified channel, not by forwarding the suspicious email.
2. Explain how the representative should send the 12 MB PDF to 40 parents while respecting the 10 MB limit and protecting parents' privacy.
Read the worked answer
The PDF cannot be attached directly: it is 12 MB against a 10 MB per-message limit. The mailbox also has only 8 MB free (100 minus 92), so even one stored copy would exceed the remaining quota. Compression might reduce the PDF, but it may spoil the schedule and the result is not guaranteed to stay under 10 MB. The reliable method is to upload the PDF to the school cloud drive, set view-only permission, test the link in a private window, and email the link. Use BCC for the 40 parent addresses, or better a school mailing group, with the representative's own address in To. BCC prevents every parent from seeing the others' addresses. The message should state that the link is official and should not be forwarded outside the class group.
3. Why is BCC appropriate here? When might CC be acceptable?
Read the worked answer
BCC is appropriate because the recipient list is large and the parents have not agreed to share their email addresses with one another. Using To or CC would disclose 40 addresses and enable reply-all storms or later misuse. BCC keeps each recipient's address private while still delivering the same notice. CC can be acceptable for a small group that already knows one another, such as three teachers who all need to see who else received a coordination message. Even then, the sender should ask whether addresses may be shared. For parents, the default should be BCC or a mailing group, especially when the message contains exam schedules or student-related information.