I85PREP
⌘ K
Karnataka KSEAB II PUC Information Technology (Vocational) study materials
Karnataka KSEAB II PUC Information Technology (Vocational) study resources

A Scholarship Email and a Public Link to Sensitive Certificates

Karnataka KSEAB II PUC Information Technology (Vocational) · Put your knowledge to work in context.

All case studies

A Scholarship Email and a Public Link to Sensitive Certificates

A II PUC student receives an email with a government-looking logo. It says the “State Scholarship Board” will release ₹15,000, but the student must click http://scholarship-kar.top/verify within 24 hours and enter Aadhaar number, bank account, IFSC, and the OTP sent to the registered mobile. The email address is [email protected], and the message asks the student to forward it to five friends. A classmate says the logo looks real, so it must be genuine. In the same week, a teacher asks students to upload scanned caste and income certificates to a free public file-sharing site and post the link in a 60-member class WhatsApp group for a “documentation project.” The student also receives a WhatsApp message asking them to install a “camera improvement” APK from bit.ly/camfix-apk before online classes. The school has no written data policy.

1. Identify at least four red flags in the scholarship email and explain why each matters.

Read the worked answer
  1. Sender address: [email protected] is a free Gmail account, not an official government domain. Official scholarship portals use a controlled domain; a Gmail address can be created by anyone.
  2. Link domain: scholarship-kar.top is a cheap, unfamiliar top-level domain, not a government domain. The lookalike wording is designed to appear official.
  3. Urgency: “within 24 hours” pressures the student to act before checking. Genuine schemes usually publish timelines and allow verification.
  4. OTP request: No legitimate scholarship board needs the OTP sent to the student’s mobile. The OTP is the last lock on the bank account; sharing it authorises a transaction.
  5. Excess data: Aadhaar, bank account, IFSC and OTP together are enough to attempt identity/financial fraud. The “forward to five friends” request is also a classic chain-mail tactic that spreads the link. The realistic logo proves nothing; logos are easy to copy.

2. The student already entered Aadhaar and bank details but not the OTP. Give a step-by-step safe response.

Read the worked answer
  1. Do not enter the OTP. Close the page; do not call any number in the email.
  2. Contain the bank risk: call the bank’s official number on the back of the card/passbook, tell them the account details were exposed, ask to block UPI/card transactions and watch for debits. Change the banking password and UPI PIN from the official app, not from a link.
  3. Report: file a complaint on the national cybercrime portal or call the cybercrime helpline (1930 in India), and inform the school and a parent/guardian. Keep screenshots of the email, URL and headers.
  4. Protect identity: monitor for unknown SIM/loan requests; do not share the OTP even if someone claims to be “releasing” the scholarship.
  5. Clean up: run an antivirus scan, change reused passwords, and warn classmates not to open the link. Aadhaar alone is sensitive; combined with bank details it raises the risk, so reporting early matters.

3. Recommend an ethical and safer way to share the scanned caste and income certificates with the class, including privacy reasoning.

Read the worked answer

The documents contain caste and income data, which are sensitive personal information. Posting them on a free public file-sharing site and dropping the link in a 60-member WhatsApp group means anyone with the link-and possibly search engines-can copy them; the school cannot control onward sharing. That violates data-minimisation and purpose-limitation principles: collect only what is needed, use it only for the stated documentation project, and delete it afterwards.

Safer plan: use the school’s own learning management system or a password-protected folder with access limited to the teacher and project group; share individual files only with the teacher, not the whole group; redact unnecessary fields (e.g. full Aadhaar, account numbers); get written consent; set an expiry date and delete the files after verification. If a public link is unavoidable, use a password-protected archive with the password sent separately, and never post it in a group. The teacher should also check whether the school has a data policy; if not, the principal should approve one.