The 'Last Four Digits of Aadhaar' Email

Red flags, one by one.

1. Lookalike domain. The sender address is school-exam-results.in - plausible, but not a domain the school controls. Attackers register names that read like institutions.
2. Misleading link destination. The text says one thing; the real address is a subdomain school-exam-results.in.verify-login.xyz. The genuine domain of that URL is verify-login.xyz; everything before it is decoration that the attacker chose. This is the single most important habit: read a URL from the right-hand side.
3. http, not https. No transport encryption and no certificate check, so anything typed is readable in transit.
4. Reply-To mismatch. Replies would go to a free Gmail account, not the institution. Legitimate bulk mail rarely behaves this way.
5. Manufactured urgency. 'Closes today at 6 PM' is designed to stop verification. Deadlines are the standard lever of social engineering.
6. Excessive data request. A roll number plus date of birth is enough to identify a candidate. Asking for part of an Aadhaar number, by email, to 'confirm marks' has no legitimate purpose - this is a data-minimisation violation before it is even a scam.

Actions in order.

1. Do not click, do not reply, do not forward the link to anyone.
2. Verify independently: contact the school office or exam coordinator by a phone number already known, never a number in the email.
3. Report the message to the school IT contact, and to the platform's phishing report facility.
4. Warn Aditya and the class group in plain words: the email is fake, nobody should open it.
5. If the school genuinely must collect data, it will be through an official portal the school announces in advance, without Aadhaar fragments in email.

What is likely happening. The form harvested his identity details, and the caller is now trying to complete a login or transaction that requires a second factor. The OTP is the second factor precisely because the password alone is not enough - so the caller is one step short. If the OTP is a bank or UPI code, the caller may be adding his account to a wallet or authorising a transfer. If it is an email or account recovery code, the caller may be seizing an account. Either way, the OTP is the last lock, and the caller cannot proceed without it.

Why 'just read the last four digits' is dangerous. Data fragments combine. Date of birth, roll number, name and four Aadhaar digits are enough to answer security questions, impersonate him on a support call, or make the next call more convincing. There is no legitimate reason for an exam cell to call a student for an OTP.

What he must do, now.

1. Do not share the OTP. Hang up. Do not call back on the number that called him.
2. Do not delete the SMS - it names the service the code is for, which tells him what is being attacked.
3. If it relates to a bank or UPI app, call the bank's official number, check recent transactions and block or freeze the card/account if anything is unauthorised.
4. Change the password on the affected account and any account reusing that password, and turn on two-factor authentication.
5. Tell a parent, the school, and report to the national cybercrime portal (cybercrime.gov.in) or helpline 1930 quickly - early reporting improves the chance of freezing a fraudulent transfer.
6. Watch for follow-up calls that claim to 'help' - the second call is often part of the same scam.

What is wrong, in layers.

• Access setting. 'Anyone with the link can view' means no sign-in, no identity, no audit trail, and no way to revoke access already downloaded. The link is now in a 90-member WhatsApp group, so it should be treated as public.
• Nature of the data. Medical records of minors are among the most sensitive categories there are. Even 'just name and a diagnosis' can cause real harm through stigma or bullying.
• Purpose and minimisation. The folder exists for a legitimate purpose (say, sports-day fitness checks), but that purpose does not justify open-ended sharing to a class group.
• Legal framing. India's data protection law treats a school as a data fiduciary: it must collect only what is needed, state why, secure it, and handle children's data with particular care, usually with verifiable parental consent. Unauthorised access or disclosure of such data can also attract liability under the IT Act. The exact obligations and penalties should be checked against the current text of the Act rather than quoted from memory.

What Riya should do.

1. Do not open or download files she does not need; do not forward the link again.
2. Tell the principal or the designated data contact immediately - same day.
3. Restrict the folder to specific named staff accounts, then remove the link.
4. Ask for the WhatsApp message to be deleted, and post a request that nobody forward it. Deletion is imperfect, but it reduces spread.
5. Keep a short record of who had access and when - a breach record matters later.

What the school should change. A written rule that sensitive folders are never link-shared; two-person approval for sharing student data externally; retention limits so old medical files are deleted, not archived forever; a named data owner; and awareness sessions so the next Riya does not have to make this call alone.