The 24-Hour Aadhaar Verification Email
On a Sunday evening, a Class X student in Nadia receives an email on her school-registered address. The sender name shows 'WB Scholarship Cell', the address is [email protected], and the message says her post-matric application is on hold for an Aadhaar mismatch, with a 24-hour deadline. It asks her to open a link, log in with her Aadhaar number, and enter the OTP that will arrive on her father's phone. The page carries the state emblem and a form, but the browser shows 'Not secure' and the address bar reads wb-scholarship-verify.xyz. Her friend says it must be genuine because the logo looks right and the mail came to her school ID. Her cousin, meanwhile, asks her to install a cracked office suite from a pen drive on the school laptop so they can finish a project tonight. The teacher has asked her to prepare a short class advisory.
1. Should she click the link and complete the form? Give the reasoning behind the decision and the exact steps she should take next.
Read the worked answer
Do not click, and do not enter Aadhaar or the OTP. Four independent signals contradict the claim: (1) the visible page is on wb-scholarship-verify.xyz, a different domain from the sender address - the real domain is the part immediately before the first single slash; (2) the browser says 'Not secure'; (3) a 24-hour deadline is manufactured urgency; (4) the request is for two high-value secrets, an Aadhaar number and a live OTP. No genuine office needs an OTP it has just generated.
A logo proves nothing, and a school email address only proves the sender knows that address.
Steps: take a screenshot; do not forward the mail onwards; report it to the teacher and the school's nodal officer; verify independently by typing the official portal address herself or by phone; if anything was already entered, tell her father and the school immediately, change the relevant passwords, and report at cybercrime.gov.in or on 1930.
2. How should she answer the cousin's request to install cracked software on the school laptop? Frame this as a judgement, not a lecture.
Read the worked answer
Refuse, and give reasons the cousin can act on. Three hazards, in order of immediacy:
- Security: cracked installers are a standard malware route. On a school laptop this risks other students' files and the school network, not just this one machine.
- Integrity of the work: a cracked build may corrupt files or fail mid-presentation; a project that crashes at submission is worse than a late one.
- Legal and professional: using unlicensed software breaches the licence and school policy, and a vocational IT student is assessed on professional practice, not only on output.
Offer alternatives rather than a dead end: an open-source office suite, the licensed machines in the school lab, or a cloud editor signed in with the school account. If the deadline is genuine, the honest move is to tell the teacher tonight and ask for lab time - that is a scheduling problem, not a reason to break policy.
3. Draft four rules for the class advisory on protecting personal data and verifying senders. Each rule must be something a Class X student can actually do.
Read the worked answer
Class advisory - four rules
- Never share an OTP, Aadhaar number, bank PIN or password with anyone who contacts you first. Government offices and banks do not ask for OTPs by mail, call or form.
- Check the address bar, not the logo. The real domain sits just before the first single slash; a padlock alone only means the connection is encrypted, not that the sender is genuine.
- Treat urgency as a warning sign. Phrases like 'blocked in 24 hours' are designed to stop you checking. Verify by typing the official address yourself or by calling the school office.
- Report, don't forward. Screenshot the message, tell a teacher, and report at cybercrime.gov.in or 1930. Forwarding spreads the risk to friends.
Close with one line - 'When in doubt, ask before you click' - and the school's contact number.