A Scholarship Email That Asks for an OTP
Navjot, a Class 10 student in Amritsar, receives an email from 'PSEB Scholarship Cell [email protected]' with the subject 'URGENT: ₹15,000 scholarship - 24 hours left'. It says his Aadhaar number and bank account details are needed to release the money and gives the link 'http://pseb-scholarship.xyz/apply'. The logo looks like the board's. His friend Parmeet forwards the same mail saying he already filled the form and got an OTP on his phone which he entered. Navjot is about to fill it on a cyber café computer, where he also plans to check his bank balance and log in to his Gmail. He uses the same password 'navjot2010' for Gmail, Facebook and the bank's net banking.
1. Identify at least four phishing indicators in the email and explain why each is suspicious.
Read the worked answer
1. The sender address is a free Gmail account. An official board or scholarship cell writes from its own domain, not from @gmail.com. Anyone can create a Gmail address containing official-looking words.
2. The domain in the link is pseb-scholarship.xyz. The real organisation's domain would come before the first slash; the .xyz ending is cheap and commonly used for temporary scam sites. A lookalike word such as 'pseb-scholarship' is not the same as the official name.
3. The link uses http, not https. There is no padlock or certificate, so anything typed can travel in clear text and be read in transit.
4. Urgency and a deadline. '24 hours left' is pressure designed to stop the student from checking through official channels.
5. It asks for Aadhaar and bank details by email. Genuine scholarship processes use a school or official portal; they do not collect Aadhaar and account numbers through an email link.
6. It is unsolicited. Navjot never applied, so there is no reason for a scholarship to be waiting for him.
2. Parmeet has already entered the OTP. Explain what may have happened and list the immediate steps he should take, with reasons.
Read the worked answer
The fake page almost certainly relayed the OTP to the attacker in real time. An OTP is only useful for one action, but that action can be enough: completing a UPI transfer, adding a beneficiary, changing the registered mobile number, or setting up an automatic debit. Parmeet believes he was verifying a scholarship; the attacker was authorising a transaction.
Immediate steps:
- Call the bank's official number printed on the card or passbook - not a number from the email - and ask to block the card and net banking and freeze the account.
- Check the statement and transaction alerts for unknown debits and note the time and amount.
- Change the bank password and the Gmail password from a different, trusted device, and enable two-factor authentication.
- Report quickly at cybercrime.gov.in or call 1930. Early reporting within the 'golden hour' gives the bank a chance to freeze the transfer.
- Keep screenshots of the email, the link and the OTP message, and tell a parent or teacher.
- Do not pay anyone who promises to recover the money; recovery scams target victims a second time.
3. Advise Navjot on using the cyber café and on his password practice, and explain why using one password everywhere is risky.
Read the worked answer
Cyber café: a shared computer may have a keylogger, a screen recorder or a browser set to remember passwords. Navjot should not log in to net banking there at all. If he must check email, he should use his own phone and mobile data where possible, never tick 'remember me', log out of every account, close the browser, and avoid leaving documents or printouts behind. Private or incognito mode hides local history but does not stop a keylogger, so it is not protection. He should also avoid typing his Aadhaar or bank details on any café machine.
Password practice: navjot2010 is a name plus a probable birth year - easy to guess and easy to find on social media. Reusing it across Gmail, Facebook and banking means one leak compromises all three. If the phishing page captures it, or if any one site is breached, the attacker can try the same password on the bank, and can use the Gmail account to reset other passwords. He should use a different, longer passphrase for each important account, a password manager if available, and turn on two-factor authentication for Gmail and banking. OTPs should never be shared with anyone, even someone claiming to be from the bank.