A Paid Internship Message That Asks for Aadhaar and a Fee
A Class 10 student who has just created a professional profile receives a WhatsApp message from a number using a company logo. The sender says the student has been selected for a paid 'data entry internship' at ₹18,000 per month, work from home, and asks for Aadhaar, PAN, a bank passbook photo and a ₹499 'registration fee' within two hours. The message includes a shortened link (bit.ly/...) and says the offer expires at 6 p.m. The student's friend received a similar message with a different company name. The student has used the same password 'Rohit@2010' on the profile, email and school portal, and has saved it in a browser. The student wants to pay quickly because the fee is small compared with the salary, and asks whether sending Aadhaar is safe if the company has a logo. The family has a bank account in the student's name but no credit card.
1. Identify at least four red flags in this message and explain why each matters.
Read the worked answer
Red flags include: (1) a job offer and selection without any application or interview; (2) a fee for an internship, described as small to lower resistance; (3) a two-hour deadline and 'expires at 6 p.m.' urgency, which is designed to prevent checking; (4) a shortened link that hides the real domain; (5) a request for Aadhaar, PAN, bank passbook and identity data before any contract; (6) a logo and WhatsApp number are not proof of a company, because logos are easy to copy; (7) the friend received the same message with a different company name, indicating a template scam. The ₹18,000 salary is bait: a genuine employer does not need a registration fee from an intern. Aadhaar and PAN are sensitive identity documents; sharing them can enable impersonation, loan fraud or SIM misuse. The small fee is not the main loss; the documents and bank details are.
2. What sequence of actions should the student take, including whether to pay or send documents?
Read the worked answer
Sequence: do not pay and do not send documents. Take screenshots of the chat, profile, number and link. Do not open the shortened link; if it was opened, close it and do not enter data. Verify the company independently through its official website, not the link, and call a published number. Report the number and message to the platform and to the cybercrime helpline or national portal; if money was paid or documents sent, report immediately to the bank and police. Tell the family and school counsellor. Because the family account is in the student's name, a fraudster with Aadhaar, PAN and passbook photo could attempt identity fraud. A legitimate employer will accept masked documents later through a formal onboarding process after a written offer. The decision rule: urgency plus payment plus identity documents equals stop.
3. The student has reused a password and saved it in a browser. What account-protection plan should the student follow now?
Read the worked answer
Immediate: change the password on the profile, email and school portal. Use a unique passphrase of at least 12 characters, not a name plus birth year. Enable two-factor authentication on email and the professional profile, preferably an authenticator app rather than only SMS. Check account recovery email, phone, active sessions and connected apps; remove unknown devices. Do not reuse the old password anywhere. Use a password manager or a written locked record, not browser saving on a shared computer. Check whether the school portal exposes personal details and set the profile to private. Because the password was reused and saved in a browser, assume it is compromised; changing it on one site is not enough. Monitor bank messages and report unknown transactions.