The Fake Revaluation Email
A Class XI student receives an email from exam-results-portal.net claiming to be from the school exam cell. The subject says "Revaluation result available for 24 hours". The message greets the student as "Dear Student" and asks them to log in with their roll number, date of birth and marks-portal password at a link beginning with http://. The school's actual portal is hosted on a different domain and uses https. The same week, a friend offers the student a cracked copy of a paid photo-editing program, and a free quiz app asks for permission to read the phone's contacts before it will start. The student is unsure which actions are unsafe, which are unethical or illegal, and what should be reported to the school.
1. Identify at least four indicators that the email is a phishing attempt and describe the immediate actions the student should take.
Read the worked answer
The sender domain exam-results-portal.net is not the school's official domain, which is the strongest clue. The greeting is generic rather than using the student's name. The 24-hour deadline creates urgency and discourages verification. The link uses http rather than https, so data would travel unencrypted. Most importantly, a genuine portal never asks for the marks-portal password by email. The student should not click the link or enter any data. They should report the email to the exam cell or IT coordinator, preserve it as evidence rather than deleting it immediately, and check results only by typing the official portal address. If the password was already entered, it should be changed at once and the incident reported. The student should also warn classmates, because a phishing campaign usually targets many recipients.
2. Analyse the two other situations: the cracked software and the quiz app's contact permission. Explain the ethical and legal issues involved and give a reasoned recommendation for each.
Read the worked answer
Using cracked software is software piracy. It violates the licence agreement and infringes copyright, and in India the Copyright Act, 1957 provides for civil and criminal remedies for unauthorised copying and distribution. Cracked installers also commonly carry malware, so the ethical problem is combined with a security risk. The recommendation is to refuse the copy and use a free or school-licensed alternative. The quiz app's request for contacts is excessive: a quiz does not need the contact list to function. Granting it shares other people's personal data without their consent, which is a privacy problem and may also breach data-protection principles. The recommendation is to deny the permission, or not install the app, and to check whether permissions can be limited in settings. In both cases the test is whether the action respects the rights of creators and of other people whose data is involved.
3. Draft a short awareness notice for the school noticeboard covering password safety, phishing and reporting. Include three concrete rules and explain why each rule reduces risk.
Read the worked answer
Notice: Protect your marks-portal account. Rule 1: Use a long, unique passphrase for the portal and never reuse a social-media password; if one site leaks, the reused password exposes the others. Rule 2: Treat every unexpected link or attachment as suspicious; type the official address yourself and check for https and the correct domain before logging in. Rule 3: Never share a password or OTP with anyone, including someone claiming to be a teacher or helpdesk; school staff do not need your password. Add that any suspicious message should be reported to the exam cell or IT coordinator with a screenshot, and that a suspected account compromise should be followed by an immediate password change. The notice should also mention that installing cracked software and granting unnecessary app permissions are both security and ethics issues. Keeping the rules short and specific makes them more likely to be followed.