Be cautious when checking 10th-grade scores: Do not expose your child's personal data

The conclusion of the 10th-grade entrance exam marks the beginning of an anxious waiting period for hundreds of thousands of students and parents nationwide. Exploiting families' eagerness to know the scores, cybercriminals immediately set up sophisticated traps to steal users' Personally Identifiable Information (PII).

Phishing tactics: Spoofing score-checking websites to harvest data

During every exam result announcement season, popular social media platforms like Facebook, Zalo, and TikTok are flooded with promotional posts featuring links for "hyper-speed score lookups," "early exam results," or "pre-release outcomes." To build trust, scammers design these websites to look identical to the official portals of the Departments of Education and Training.

Threat actors design a series of websites with interfaces identical to official government portals

When accessing these malicious links, parents are prompted to fill in details such as:

• Student's full name and candidate number.

• Contact phone number.

• National ID number.

• One-Time Password (OTP) or other related personal data.

According to warnings from cybersecurity experts at WhiteHat, all gathered data will be exploited by threat actors for unauthorized advertising, online scams, or other cyberattacks. Therefore, users should only look up scores through official portals of the Ministry of Education and Training, local DOETs, or legitimate websites officially announced by schools.

Risks stemming from Google search habits

Many users habitually open Google and type quick search phrases like "10th-grade exam score lookup," "view 10th-grade results," or "fastest exam score check." However, threat actors leverage Search Engine Optimization (SEO) manipulation techniques or invest in paid online ads to push fraudulent websites to the top of search result pages.

If parents do not carefully observe and verify, they can easily click on these phishing websites. To prevent this, parents should keep the following in mind:

• Access directly by typing the official URL of the DOET or the information channel provided by the school or local educational authority.

• Carefully check the domain name of the website before entering any information.

• Leave the site immediately if the domain looks suspicious, the interface is poorly designed, or it requests excessive private information.

Always verify information from official sources

The admission result announcement phase is a highly sensitive period when various scams related to enrollment, admissions, or school counseling flourish.

To protect themselves and their families, parents and students must always verify information from official sources

To safeguard themselves and their families, parents and students must strictly adhere to these principles:

• Only trust information released by authorized educational agencies.

• Absolutely never enter personal data into websites of unknown origin.

• Do not click on any unfamiliar links sent by strangers.

• Do not believe solicitations or advertisements for services claiming to offer "early score viewing," "pre-announced results," or "assistance in altering and boosting exam scores."

Inadvertently aiding cybercriminals by flaunting children's scores online

After learning the scores, many parents habitually post full-screen screenshots of the exam results on Facebook or community groups to share their joy with friends. However, this action inadvertently exposes a wealth of sensitive data, including: full name, candidate number, date of birth, school, and other enrollment-related information. For threat actors specializing in data harvesting and online fraud, this information is highly valuable.

To prevent children from becoming victims of phishing websites or data leaks on social media, WhiteHat experts advise parents who wish to share their children's achievements to:

• Completely hide or blur the candidate number.

• Conceal the date of birth.

• Crop out all other unnecessary data fields.

• Keep only the specific scores if they absolutely must post.

Proactively limiting the sharing of private data will minimize the risk of being targeted by malicious text messages or phishing calls in the future. A single moment of carelessness or dropped guard can lead to a student's information being leaked widespread and exploited for malicious purposes.

---

In today's digital age, securing personal data is just as vital as protecting physical assets. When checking 10th-grade exam results, parents and students should always prioritize official channels, carefully verify website addresses, and strictly limit posting sensitive details on social media to avoid becoming prime targets for cybercriminals.