Illustrated with AI

Cybersecurity for Juniors · Book 2 · Chapter 2

The Internship Offer That Wasn't

Big idea: real jobs pay you, they never charge youClasses 9–12 & College

Part 1 · An email that found her first

Naina had applied to exactly zero internships so far. It was only the second week of college, and the placement talks hadn't even started. So when an email landed in her inbox with the subject line "Congratulations! You've been shortlisted, Summer Internship 2027 at NexGen Cyber Solutions," she read it twice before she believed it was addressed to her.

It was. Her full name was right there in the first line, spelled correctly, followed by a warm paragraph about her "impressive academic profile" and a stipend figure that made her sit up straighter on her hostel bed.

"I didn't even apply," she said out loud, to nobody in particular.

Part 2 · "Everyone's getting this. I got one too."

Rehan, passing by her open door with a cup of mess-hall tea, leaned in to look. "Lucky," he said, scrolling his own phone a second later with a slightly less impressed face. "I got one too. Different company, same stipend, almost the same letter. Guess we're both geniuses."

Neither of them had applied anywhere. Neither letter mentioned a single interview, test, or even a resume upload. Both simply announced, warmly and confidently, that a seat was already reserved.

"Maybe they scout freshers early now," Rehan shrugged, already typing a reply. "Companies do that, right? Spot talent before anyone else does?"

Naina wasn't typing anything yet. Something about being "selected" for a process she'd never entered sat a little oddly, even next to a stipend figure that large.

Part 3 · The fine print under the congratulations

Close-up of a phone screen held by Naina (long black hair in a ponytail, glasses) showing a glossy internship offer email with a UPI QR code, a countdown-style line reading "Reply within 2 hours", and a request to attach Aadhaar card and bank passbook photo, Naina's expression shifting to a worried frown.

She scrolled down instead. Past the congratulations, past the stipend, to the part every real offer letter she'd ever heard of skipped entirely: a UPI QR code, and a line asking for a "refundable registration and verification fee of ₹2,499, to be paid within the next 2 hours, after which the seat will be offered to the next candidate."

Below that, a second request: "Please attach a clear photo of your Aadhaar card and bank passbook so our HR team can begin processing your offer letter and first stipend disbursal."

"Rehan," she called across the corridor. "Does yours ask for money too?"

A short pause. Then, less confidently than before: "...Yeah. I was about to pay it, actually."

Part 4 · Ananya didi opens the email headers

Ananya didi (hair in a neat braid, college hoodie over a kurta, laptop bag with a Cyber Cell lanyard) sitting with her laptop open showing raw email header text, Naina and Rehan watching over her shoulders in a hostel common room.

They found Ananya didi in the common room before either of them had paid anything. She read the email once, didn't look surprised, and clicked a small menu option Naina had never noticed existed: "show original."

The name on the screen still said NexGen Cyber Solutions HR. The actual address underneath it said something else entirely: nexgencyber.hr@gmail.com.

"A real company's HR team sends mail from the company's own domain," Ananya didi said, turning the screen so they could both see it. "Not a free personal Gmail account wearing the company's name like a costume. The display name is just text. Anyone can type 'NexGen Cyber Solutions HR' into that field. The address after the @ is what actually tells you who hit send."

A quick search for "NexGen Cyber Solutions" turned up a real company, with a real website and a real careers page, neither of which mentioned any such internship, any such deadline, or any such fee.

Part 5 · Divya ma'am's "placement cell doesn't work like this"

Divya ma'am, a woman in her mid-30s, shoulder-length hair neatly tied back, wearing a blazer over a saree, a laminated "Placement Cell" ID lanyard around her neck, sitting at her office desk pointing at her computer screen showing the official placement portal, Naina (long black hair in a ponytail, glasses) and Rehan (lean build, messy curly hair, graphic tee) listening with Ananya didi (hair in a neat braid, college hoodie, Cyber Cell lanyard) standing beside them.

Ananya didi walked them straight to the Placement Cell office, where Divya ma'am, who had seen three versions of this exact email that same week, barely needed to read it before sighing.

"No company we work with has ever asked a student to pay anything, at any stage," she said. "Not for registration, not for 'processing,' not for a laptop, not for training material. If a company wants to hire you, they spend money to find you. You never spend money to be found."

She pulled up TEC's actual placement process on her screen: every approved company listed on the official portal, every interview either on campus or through a verified video call arranged by her office, every result emailed from an address ending in the college's own domain, never a personal one.

"And nobody," she added, "ever needs your Aadhaar or your bank passbook before you've even had a single interview. That's not an HR process. That's identity theft, wearing an offer letter as a disguise."

Part 6 · The others who already paid

Divya ma'am (mid-30s, hair tied back, blazer over a saree, Placement Cell lanyard) pinning a bold warning notice to a crowded hostel noticeboard, a small group of worried-looking freshers nearby, Ananya didi (hair in a neat braid, college hoodie, Cyber Cell lanyard) standing with a laptop under her arm.

Divya ma'am sent a single message to the hostel wardens' group that evening, asking anyone who'd received a similar "congratulations" email to come by her office, no judgment, before paying anything if they could.

Six freshers, across three different hostel blocks, had already paid. Two had already sent photos of their Aadhaar cards. One had been asked, politely and cheerfully, for a "second verification fee" the very next morning, with the first one apparently not quite enough after all.

"That's the part that always gets missed," Ananya didi said quietly, once the six had been guided through filing a complaint on the national cybercrime portal. "It's never just one fee. The moment you pay the first one, you've told them you will."

Part 7 · A notice before the next batch of emails

By the end of the week, Divya ma'am's office had a new rule pinned to the placement noticeboard, the WhatsApp groups, and the student portal's login page, all at once: "Any internship or job offer you did not apply for, from a company you don't recognise, asking for any payment or your personal documents before an interview, is not real. Forward it to the Placement Cell before you reply to it, not after."

Rehan never sent his ₹2,499. He did, however, spend a solid ten minutes trying to explain to his hostel-mates why he'd nearly fallen for an email addressed, in his words, "to a genius."

"Everyone falls for the version aimed at them," Naina told him, not unkindly. "Mine said 'impressive academic profile.' Yours said 'genius.' Divya ma'am's inbox probably has fifty different compliments in it this week alone."

Moral of the story

A real job offer pays you. The moment one asks you to pay first, it has already told you everything you need to know.

A letter sweet with praise and gold
may hide a hand that wants to hold
your name, your bank, your card, your fee,
before you've asked, "but who are we?"

Spot the red flags

The "Congratulations" Email

"Congratulations! You've been shortlisted, Summer Internship 2027" 1

From:NexGen Cyber Solutions HR <nexgencyber.hr@gmail.com>2

Action needed:Pay ₹2,499 within 2 hours to confirm seat3

"Attach a clear photo of your Aadhaar card and bank passbook to begin processing your offer letter" 4

Being "selected" for a process you never entered, with no application, interview, or test anywhere in the story, is the very first sign something's off.

A display name is just text anyone can type. The real sender is the address after the @, and a free personal email account is not where a genuine company's HR team operates from.

Urgency and a payment, together, are close to a universal scam signature. Real offers don't expire in two hours, and real employers never charge candidates.

Government ID and bank details, requested before any real verification has happened, are the actual prize. The "internship" is just the bait.

Field notes

What really happened?

In the story	The real idea
"Congratulations, you're shortlisted," with no application on record	Recruitment fraud: a fake job or internship offer sent to people who never applied, designed to feel earned instead of random
₹2,499 "registration and verification fee," refundable, urgent	Advance-fee fraud: paying upfront for a reward that was never going to arrive, dressed up as a normal process step
Display name "NexGen Cyber Solutions HR," real address a personal Gmail	Checking the sender's actual domain, not just the name shown, is the single fastest way to catch most fake "official" email
"Reply within 2 hours or the seat goes to someone else"	Manufactured urgency, a classic social engineering pressure tactic that exists purely to stop you from checking
Request for Aadhaar and bank passbook photos before any interview	No legitimate hiring step needs government ID or banking details this early; it's the real target of the scam
TEC's actual process: approved companies, verified calls, official-domain emails only	What a genuine placement process looks like, useful as the comparison point for anything that arrives outside it
The six freshers who'd already paid, then got asked for a "second fee"	One payment rarely ends it; a scam that worked once is usually repeated on the same victim until it stops working

Try it yourself

Real offer, or fake?

Here are four "offer" messages like the ones that landed in Naina and Rehan's inboxes. Tap one to see whether it's genuine, and why.

Tap a message above to check it.

Maths corner

Why scammers love sending thousands of emails

Say a scammer sends this exact email to 600 freshers at one college, and only 5% reply and pay the ₹2,499 "registration fee." That's 600 × 0.05 = 30 students, and 30 × ₹2,499 = ₹74,970, from one college alone, for the cost of sending an email.

Your turn. If the same scammer sends the identical email to 50 different colleges, with the same 5% response rate at each one, how much do they collect in total? And if only 2% of victims pay a second "fee" after the first, as happened to one of the six freshers in the story, roughly how much more does that add?

Answer: 50 × ₹74,970 = ₹37,48,500 across 50 colleges. A second fee from just 2% of the original 1,500 paying students (50 × 30) is another 30 students × ₹2,499 ≈ ₹74,970 more, nearly the entire first college's haul again, for one extra message.

Try it on a computer · optional

Checking a sender's real domain in Python

# a simple domain check, real email security tools do much more
def sender_domain(email):
    return email.split("@")[-1].lower()

official_domain = "nexgencyber.in"
inbox = [
    "hr@nexgencyber.in",
    "nexgencyber.hr@gmail.com",
    "careers@nexgencyber.in",
    "nexgen.cyber.careers@yahoo.com"
]

for sender in inbox:
    domain = sender_domain(sender)
    if domain != official_domain:
        print(sender, "-> domain mismatch, verify before trusting")
    else:
        print(sender, "-> matches the official domain")

nexgencyber.hr@gmail.com -> domain mismatch, verify before trusting nexgen.cyber.careers@yahoo.com -> domain mismatch, verify before trusting

Run this in any free online Python editor. Try adding "nexgencyber.in.verify-hr.online" to the inbox list, a domain that merely contains the real one, and see that it still correctly fails to match. A lookalike domain is not the same domain, even when it contains the real name somewhere inside it.

Security tip

Five habits for any offer that finds you first

Treat any job or internship offer you never applied for as unverified until proven otherwise, flattering or not. Check the sender's actual email address, not just the name displayed on top of it. Search the company's name independently, and compare what you find to what the email claims. Never pay money, at any stage, to receive a job, an offer letter, or a stipend; the direction of payment only ever flows one way. And never attach ID documents or banking details before a verified interview has actually happened, through a channel you found yourself, not one the email handed you.

Did you know?

Fun facts

Older than email itselfAdvance-fee fraud, paying a small amount upfront to receive a much bigger promised reward, is sometimes called a "419 scam," after a section of Nigeria's criminal code once associated with it. The trick itself goes back over a century, long before the internet existed.

Your name isn't a secretA scam email that uses your real name, college, or course isn't proof it's genuine. Names and college details are often pulled from public LinkedIn profiles, leaked contact lists, or placement WhatsApp groups, not from any real application record.

India has a dedicated helplineIndia's national cybercrime helpline, 1930, and the portal cybercrime.gov.in, exist specifically for reporting fraud like fake job offers, so victims don't have to figure out where to go on their own.

Real employers compete for youLegitimate companies spend money on recruitment, campus drives, job portals, referral bonuses, because finding good candidates costs them something. A "candidate" who's asked to pay has quietly become the product, not the hire.

Myth or fact?

"If the offer letter has a company logo and looks official, it's real."

Myth

A logo is an image file. Anyone can copy one off a company's real website and paste it onto a fake letter in minutes. A professional-looking document proves someone knows how to use design software, nothing more. What actually proves an offer is real is independent verification: the sender's domain, the company's own careers page, a callback to a number you looked up yourself, not one printed on the letter.

Try this · no computer needed

Verify the recruiter

You need: paper and a pen, and at least one other person.

One person plays a "recruiter," inventing a company name and a short, exciting internship offer, including at least one made-up detail (a fee, a deadline, a document request).
The other person may not ask the "recruiter" anything directly. Instead, on paper, they list three independent ways they would verify the offer without using any information the recruiter gave them.
Compare lists: did both people think of checking the company's own website, searching for its name alongside the word "scam," or asking a placement cell or senior if they'd heard of it?
Swap roles with a new invented offer, then discuss: which verification method would have caught Naina and Rehan's emails the fastest?

Careers corner

Cybercrime investigation officer

Reports filed through India's cybercrime helpline and portal, including fake job and internship scams like this one, are investigated by cybercrime cells within the police, often working alongside banks and payment platforms to trace where money and fake accounts actually went. It's a career that mixes basic digital forensics, an understanding of how scams are built, and the patient, procedural work of building a case that holds up.

Useful to learn: how email headers and domains actually work, basic financial fraud patterns, careful documentation, and comfort explaining technical findings to people who aren't technical.

Quiz time

How well did you learn?

Score: 0 / 8

Think and discuss

No wrong answers here

Naina and Rehan both got a letter that flattered them personally. Why might a compliment aimed exactly at you be more dangerous than one aimed at "everyone"?
Rehan almost paid before Naina asked him a single question. What's one habit from this chapter that could have stopped him at the "congratulations" stage itself, before any fee was even mentioned?
Divya ma'am said real employers "spend money to find you." Can you think of examples, ads, campus visits, referral bonuses, of companies actually doing this?
Six freshers had already paid before the notice went up. What makes it hard to admit you've fallen for something like this, and why might that silence help the scam spread further?

Be curious

Ask a teacher, parent or engineer

Have you or someone you know ever gotten a job or internship offer that turned out to be fake? How do you usually check if a company email is genuine? What's India's cybercrime helpline number, and have you ever had to use it? Has your workplace or college ever warned students about recruitment scams? What's one question you'd ask any "recruiter" before replying to them?

Word bank

New words from this chapter

Recruitment fraud: a fake job or internship offer designed to look like a genuine hiring process.

Advance-fee fraud: paying a small amount upfront for a bigger reward that was never going to arrive.

Domain spoofing: making an email look like it's from a trusted company by faking the display name, while the real sending address is different.

Social engineering: tricking a person, through pressure, flattery, or urgency, into acting without checking first.

Placement Cell: a college office that manages and verifies genuine job and internship opportunities for students.

Cybercrime helpline (1930) / cybercrime.gov.in: India's official channels for reporting online fraud, including fake job offers.

Coming up in Chapter 3

The fake offer is sorted, and the real placement season is about to begin. Naina's team pushes their first group project to a shared code repository late one night, stickers, secrets, and all, and nobody notices what they accidentally left in it until someone outside the team finds it first.

For teachers and parents: this chapter fits two 40-minute periods. Period 1: read Parts 1 to 7 aloud (15 min), explore the "real offer or fake" interactive together (10 min), then the Maths corner (10 min). Period 2: "Spot the red flags" discussion, the "verify the recruiter" activity, and the quiz. The key ideas: a real job or internship never charges the candidate; the sender's actual email domain matters far more than the display name or a logo; urgency and personalised flattery are both pressure tactics, not proof of legitimacy; and India has an official channel, the 1930 helpline and cybercrime.gov.in, for reporting exactly this kind of fraud. The Python corner is optional. All chapter illustrations are AI-generated scene art (pending for this draft); the offer picker and red-flag board are built by hand.