The Principal's Urgent Email: Phishing, Password Reuse, and School Policy
On a Monday morning, the account head of a higher secondary school receives an email that appears to come from the principal's official address. It says the examination committee has flagged a payment of ₹18,500 for practical question papers and asks her to scan a QR code in the attachment and approve a UPI request within 30 minutes, or the school's affiliation will be cancelled. The email uses the principal's correct signature and the school logo. The account head is about to pay when a teacher notices that the reply-to address ends in @gmail.com. Later, a Class XII student reports that her Instagram account is posting fake scholarship links. She used the same password for her email and the school portal. The school has no IT policy, one shared 'office' email account, and no two-factor authentication.
1. List four clues in the email and the payment request that should stop the account head from paying. Explain why the 30-minute deadline is itself a red flag.
Read the worked answer
Clues:
- The reply-to address is a free Gmail account, not the principal's official domain. The visible 'From' name can be forged; the reply-to reveals where a reply would actually go.
- The email asks for payment by scanning a QR code and approving a UPI request. A school's official examination payment should go to a verified institutional account against an invoice, not to an individual UPI request.
- It threatens cancellation of affiliation within 30 minutes. Real examination bodies do not cancel affiliation by email with a half-hour deadline.
- The logo and signature are copied from a real email; visual familiarity is not authentication. The attachment and QR code are also unsolicited.
The deadline is a red flag because urgency is designed to stop the victim from phoning the principal, checking the bank account, or asking a colleague. Genuine financial processes allow verification and have a purchase order or reference number. The correct response is to stop, not to race. The account head should call the principal on a known number - not the number in the email - and confirm whether any payment was requested.
2. Give an ordered response plan from the moment the teacher notices the reply-to address. Include what to do with the email, the bank, cybercrime reporting, evidence, and internal communication. State two things not to do.
Read the worked answer
- Do not pay. Stop the UPI approval immediately and confirm no money has left the account.
- Verify by a separate channel. Call the principal on a saved number or speak in person. Do not reply to the email and do not use a phone number printed in it.
- Preserve evidence. Keep the email, expand and save the full headers, screenshot the QR code and the reply-to address, and note the time. Do not delete or forward it to all staff.
- Notify the bank if any payment was made or if card/UPI details were entered. Ask for the transaction to be frozen or reversed and record the complaint number.
- Report to cybercrime authorities through the national cybercrime portal or the 1930 financial-fraud helpline, using the preserved evidence. The school should also inform its bank relationship manager.
- Secure accounts. Change the office email password, enable two-factor authentication, check sent items, forwarding rules, and recovery settings, and sign out other sessions.
- Communicate internally through a separate channel: tell staff a phishing email is circulating, give the exact subject line, and tell them not to scan the code. Inform parents/students only if their data may be exposed.
Do not: reply to the sender or click the QR code to 'test' it; forward the email widely, which spreads the malicious link and destroys some header evidence.
3. Explain how one leaked password compromised both the student's Instagram and school portal accounts, and propose two concrete controls for the school's shared office account.
Read the worked answer
The student reused the same password on Instagram and the school portal. If Instagram is breached, or if she enters the password on a fake scholarship page, the attacker has a working username-password pair. Attackers then try the same pair on email, the school portal, and other sites - credential stuffing. Because the school portal may use the roll number or email as the username, the attacker does not need extra information. One leak therefore becomes two compromises, and the Instagram account can be used to phish her contacts, spreading the problem.
Control 1: stop using one shared office account. Create named accounts for the account head and office staff, with the shared mailbox accessed as a delegated mailbox. If a shared account is unavoidable, require two-factor authentication on it and limit who can sign in. Named accounts make it possible to see who sent or deleted a message.
Control 2: enforce unique passwords and 2FA. Use a password manager to generate a different long password for the office email and the school portal, and enable two-factor authentication on both. For the student, change both passwords, enable 2FA on Instagram, revoke active sessions, and check linked email addresses. The school should also add a simple rule: no payment or credential change is approved on the basis of an email alone; it must be verified by phone or in person.