One Password, Three Accounts, and Three Messages
Ankit, a Class 10 student in Rohtak, uses one password, "ankit123", for his email, his Facebook account and the school result portal. He studies at a cyber café twice a week because his home has no computer.
On Monday his phone shows: (a) an SMS from "SBI-KYC" saying his debit card is blocked and that he must update KYC within 24 hours at sbi-kyc-verify.xyz or Rs 4,999 will be debited; (b) a WhatsApp message from an unknown number with a new photo of his uncle, asking Ankit to send the OTP that "just came to your phone"; (c) a friend request from an account using his classmate's photo and name, created last week, with only 4 friends.
On Tuesday Ankit posts a clear photo of his exam admit card on a public Instagram account with the caption "exam tension", and logs into the school portal at the cyber café, ticking "save password" when the browser offers to.
1. Classify each of the three contacts (a), (b) and (c) as safe, suspicious or fraudulent, giving the specific evidence used and the action Ankit should take in each case.
Read the worked answer
(a) Fraudulent. Evidence: the link is sbi-kyc-verify.xyz, not the bank's real domain (sbi.co.in); a bank never asks for KYC through an SMS link; the 24-hour deadline and the threatened Rs 4,999 debit are pressure tactics; the sender name is spoofable. Action: do not tap the link, do not call any number in the message; forward the SMS to 1909 as spam, report at cybercrime.gov.in or 1930 if anything was entered, and check the account only through the official app or branch.
(b) Fraud attempt, even though it looks like family. An OTP is the second factor - whoever holds it can complete a transaction or login. A matching photo proves nothing because photos are public. Action: never forward the OTP; call the uncle on the number already saved in the phone; a genuine relative does not need the code. Report and block the number.
(c) Suspicious impersonation. Evidence: account created last week, only 4 friends, copied photograph, out-of-the-blue request. Action: do not accept; verify with the classmate in person or on the known number; report the profile to the platform as fake.
The rule: judge by verifiable evidence - domain, account age, urgency, and requests for secrets - not by the name or photo shown.
2. Explain why using "ankit123" on three services turns one leaked password into three compromised accounts, and give three concrete changes, including what Ankit must do at the cyber café.
Read the worked answer
Why reuse is dangerous: if any one of those services is breached - or a cyber-café key-logger captures the keystrokes - attackers try the same email and password pair everywhere. This is credential stuffing, and it works only because the credential is reused. The school portal is the weakest link: small portals are typically poorly protected and rarely patched, yet it hands over the password that also opens his email, and email can reset everything else.
Three changes
- Change the password today on all three accounts, starting with email.
- Use a different long passphrase for each - three or four unrelated words plus a number, different per site - and turn on two-step verification for email and Facebook.
- Use a password manager if available, so unique passwords are practical rather than memorised.
At the cyber café: never tick "save password"; type it in a private/incognito window; sign out of every site and close the browser; use "sign out of all devices" from home afterwards. Avoid banking there entirely, and check that the machine is not already logged in to someone else's session.
3. List what personal data is visible on the admit card photograph, describe two ways it could be misused, and state the correction Ankit should make plus a general rule for posting documents online.
Read the worked answer
Visible data: full name, father's name, roll number, date of birth, school name and code, exam centre, photograph, signature, and often a barcode or QR code - effectively a complete identity kit.
Misuse 1 - impersonation and forgery: the details and signature are enough to produce a fake ID card, or to answer "security questions" (date of birth, school name) on other accounts and reset a password. Misuse 2 - targeted fraud or harassment: a caller quoting the roll number and date of birth sounds convincing to a parent; the post also reveals the exam centre, which is a physical-safety issue for a school student.
Correction: delete the post, ask anyone who saved or shared it to delete it, and set the account to private. For genuine needs - sending it to a teacher, for example - crop or blur the roll number, date of birth and barcode, and send it by direct message or email rather than a public post.
General rule: never post a full image of any document - admit card, Aadhaar, marksheet, passbook, ticket - on a public account. Share the minimum detail, to the minimum audience, privately.