The Forwarded Photograph
In a Class 10 section of 46 students, a messaging group is used for homework notices. On Tuesday, a morphed photograph of a girl in the class is posted in the group with a caption. Within 20 minutes it is forwarded to two other groups and saved by at least six students. One student posts the girl's phone number and says 'call her'. Another student, whose father's phone is used for the group, receives a message: 'Your scholarship of Rs 5,000 is approved; submit Aadhaar number and the OTP sent to your father's phone at this link.' The class teacher is on leave; the IT teacher is available only after 2 p.m. The girl's parents have not yet been informed. The school has a no-mobile-phone rule, but students use phones outside class.
1. List, in order, the first four actions the students who saw the post should take. For each, explain what harm it prevents. Include one action that should not be taken.
Read the worked answer
First, preserve evidence without spreading it further: take screenshots showing the image, caption, sender's name, group name, date and time. This prevents the loss of proof if the sender deletes the post and supports any later complaint. Second, stop forwarding and ask the group admin to switch on admin-only posting or temporarily restrict the group. This prevents the 20-minute spread from becoming a school-wide circulation. Third, report to a trusted adult immediately, even though the class teacher is on leave: the IT teacher, the head teacher or a parent. This prevents the students from handling a serious privacy and harassment issue alone. Fourth, support the girl and her family: tell her what has been done, do not blame her, and let her parents decide about a complaint. If the image is sexual or threatening, the school should help report it at cybercrime.gov.in or on 1930 for financial fraud; for a child in danger, Childline 1098 is also relevant.
The action not to take is deleting the only original post in the group before evidence is preserved, or forwarding the image 'to show a teacher'. Deleting may feel like cleanup, but it destroys proof and does not remove copies already saved by six students.
2. The scholarship message asks for Aadhaar and OTP. Identify the fraud type, explain why the OTP is the critical piece, and state the immediate steps in the correct order for the student and father.
Read the worked answer
This is phishing combined with OTP fraud. The link is trying to collect identity details and, more importantly, the one-time password. The OTP is critical because it authorises a banking or UPI action; the fraudster may already have the father's card or account details, and the OTP completes the transaction. Aadhaar details increase the risk of identity misuse, but the OTP is the immediate key to money leaving the account.
The correct order is: do not share the OTP; stop communication with the sender and do not click further links. The father should call the bank's official customer care number printed on the card or passbook, not a number from the message, and ask to block the card, UPI or net banking as needed. If money has already been debited, report immediately on cybercrime.gov.in or by calling 1930, and keep the complaint number. The student should inform the school and preserve screenshots of the message, link and sender. The father should also check his account, change passwords, and consider reporting Aadhaar misuse to UIDAI. Speed matters because banks and the cybercrime portal can act fastest in the first hours.
3. Propose two rules for the class group and one school-level action that would reduce the chance of both incidents. Each rule must be practical and linked to how the harm spread.
Read the worked answer
Rule one: only the class representative and teachers may post, and forwarding of photos or personal numbers is banned. This is linked to the spread because the image reached two other groups within 20 minutes through ordinary forwarding. Admin-only posting slows the chain and makes the source visible. Rule two: no member may share another student's phone number, photo or family details without consent, and any request for money, OTP or Aadhaar must be verified with a teacher before action. This addresses the phone-number post and the scholarship link in the same rule, because both rely on personal data being used outside the group's purpose.
The school-level action should be a short digital-citizenship and reporting session for all classes, with a named trusted adult and an anonymous reporting box. The session should explain how to screenshot evidence, how to report to cybercrime.gov.in and 1930, and what the school will do. The school should also review its phone rule so students are not afraid to report because they fear punishment for carrying a phone. Rules alone will not stop a determined sender, but clear reporting routes reduce the time between the first post and adult help.