We had a pleasant surprise when one of the participants of Safety Quest 2022 shared her experience with us. Here is the video that Aabha Sardessai recorded.

Safety Quest 2022 – Aabha Sardessai

We conducted our annual Safety Quest on 18 Nov 2022. It was heartening to see 190 students participating wholeheartedly.
For those of you who would like to try the quiz at your own pace, you can visit: https://kahoot.it/challenge/008080101

We shared examples of a few young children, 10-16 years of age, who have demonstrated creative thinking in designing innovative solutions for safety, and some who have shown exceptional leadership to guide others to safety. We hope it inspires our young participants, and they also realise that they can make a difference.

While the questions were not very difficult, behind each question was some lesson or information that would have given the children better insight into the techniques, science or innovations.

Way back in 1854 John Snow carried out a neat data analytics exercise when he mapped the deaths due to cholera on the map of London, and then further added the position of the water pumps. The correlation jumps out visually to the reader, and draws a strong cause-effect relationship to the contamination of the water from a specific water pump. We included this example to help children understand the power of using data in scientific analysis.

It is heartening that the children know many answers. This builds hope that the future generation may strive to improve safety on the roads, or otherwise. They were well aware of
• distracted driving, the protection provided by helmets, and hand signals
• first aid techniques like Heimlich maneuver and CPR – the videos would have given them details about the techniques
• the effects of climate change
• the different types of fire extinguishers

There were a few questions where the scores were low, and the Safety Quest may have given some exposure to the children:
• Stop Drop and Roll : the technique used when one’s clothes are on fire
• Stubble burning : a major health hazard in the NCR region
• Cone of Vision : How it narrows as the speed of the vehicle increases
• Cybersafety : Guarding with strong passwords, and recognizing phishing
• Safely charging electronic vehicles

We hope they continue to remember these as they become adults and take on greater responsibilities.

Some children were forthcoming in sharing :

• Jyotsna V Vadivel shared how the students of her school were affected when a fellow student lost his life in a fatal crash due to the rash driving of a bus driver. The whole school lit candles in his honour.
• Vishnu Siddhartha K was very well aware of Cybersafety, and suggested that to recognize phishing attacks, we should check for spelling errors, unauthorised identities, and check that it relates to to our online activity

The Winners
The Quiz platform rewards correct answers and also the speed with which they are given. It was a close contest, and the winners of our quiz were

1. Aditya Rajiv Ratnam
2. Vishnu Sriguruganesh
3. Sooryanshi
4. Iniyaa Elaiyaraja
5. Shuban Singh

What the Children Said
With the wordcloud we ask the children to reflect on what they learnt, and as you can see there are some specific lessons being called here.

The quantitative feedback

And a few comments
• Chandana: it was wonderful
• Vishnu Sriguruganesh: I liked learning about safety rules
• Aadit Natchu: It was very interactive
• Sooryanshi Raut: very informative
• Nilaya Bandaru: I learnt a lot of new things
• Ananya Kasavajhula: I realized that road safety is the most important thing. Thank you for this amazing event. I learned a Lot
• Tamaira Nekkalapudi: I loved how you explained to us all about how to react. Thank you for this!
• Atharva Faldessai : I learned so many new things about road safety and protection against fire. Truly fun learning session.
• Aditya Rajiv Ratnam: thank you very much for the quiz. This is my 3rd time attending the Safety Quest Quiz and I learn so much every time.
• Meghana Vani: The questions were not too hard, but some were really informative. I liked the extra info at the end of each question. Thank you!

We had invited all the donors, and one of them had this to say : This is one of the best quiz programs that I am watching. Very good questions and answers by children are excellent. These future citizens are surely going to make Indian roads safer. Special compliments to the quiz master for making the program so interesting. Well done Arundhati Foundation!

***
Our Thanks!

Our sincere thanks go to the Rohini Nilekani Philanthropies for sponsoring this event. Sahana Jose and Suresh Ponappa were extremely quickly in responding to our request, and taking care of the expenses involved. I am urging our readers to read Rohini Nilekani’s new book https://www.samaajsarkaarbazaar.in/. It is a collection of over a decade of articles, interviews, and speeches by Rohini Nilekani, Samaaj, Sarkaar, Bazaar: A Citizen-First Approach, showcases her journey in the civil society sector and outlines her philosophy of restoring the balance between the state and markets, by positioning society as the foundational sector.

It’s available for free download on our site and to buy via Amazon / Flipkart.

Thank you Shyam Kokku, Dr Punith and S Ranga Ram Kumar for your kind donations and your participation! It means a lot to us.

And a big shout out to the team from QShala ( Walnut Knowledge Solutions ) – Anagha, Shilpa, Vaishnavi, Raghav. Their work in content curation, creatives, mobilizing participation, providing a great platform for the online quiz, and managing the logistics, all makes it easy for us to organize this event. And Anagha’s energy and enthusiasm to keep every one engaged through the event was just superb.

References of Safety Champions
Zen Sadavarte
Rishank Kanaparti
Jayakumar
S. R. Valava
John Snow’s map

Participants Gallery

Here are a couple of screenshots of the participants gallery

When it comes to road safety, the risks are often conveyed in terms of statistics. Yet, despite losing over 400 people every day on Indian roads, our road users seem to judge risk quite differently. We tend to minimize personal risk due to unrealistic optimism and an over-estimation of our driving abilities, leading to perceived invulnerability. But things can turn topsy turvy in a split second!

I Feel It’s Safe!

Take a look at the pics below. Each depicts a risky behaviour.  Overspeeding, overtaking on a curve at high speed, jumping lights, intentionally driving on the wrong side, is particularly aggressive risk taking. But the persons involved believe they are in complete control.

There can be internal factors affecting the driver behaviour: experience and past memory, stress, fatigue, mood. And there can be external factors as well: the road condition and signage, the environment, the group who is with the driver. These factors can lead to a failure to examine risks, poor information gathering, bias in processing information, and therefore risk perception.

The person rationalizes, and justifies the behaviour to himself – he is attending to an urgent matter, it was an important phone call, because ‘everyone is doing it’. Some people may not even realise that what they are doing is risky – it is just normal for them. People have been used to riding without helmets, so the risk perception does not change with the law. And everyone around uses the mobile phone! Sometimes it is to impress peers, although they may not admit it. Thrill seekers knowingly take high risks. Overindulgent parents who encourage children to stand up in the cars, or encourage minors to get into the driver’s seat, believe that their behaviour was safe.

This is not limited to people in the driver’s seat.

You can see in the pic, a pedestrian is taking some risk with the distracted walking.  He has probably done it many times before.

Pedestrians do have a tough time on our roads because the sidewalks are encroached, or the facilities to cross the roads are non-existent. This leads to undue risk especially when crossing broad and busy thoroughfares.

The unfortunate crash that led to the demise of Mr. Cyrus Mistry brought into sharp focus the use of seatbelts in the rear seats. How often do you see people in rear seats wearing seatbelts? It is a rarity. Mr. Mistry may have been accustomed to travel in this manner, and may have covered thousands of km in the rear seat.

Or take the example of the tragic bus crash near Tumkur in Karnataka. Was it the first time that the people were travelling in the overcrowded bus? Was it the first time that the driver has packed so many passengers in his bus? Most certainly not. The passengers rationalise that they have no other means. The driver and the transport company are keen to make the most of the opportunity for their gains, they are confident of their vehicle and their ability to control it. They can all justify the reason for their action. Plus, they had made the trip numerous times. So why not one more time?

Topsy Turvy In A Split Second

If the first risky attempt results in some injury or a near miss, the person may refrain from such behaviour. But more often than not, this passage is without any hiccups. And then, the behaviour repeats, many times over, to a point when the person has an exaggerated sense of control.

It will take just one fall to the ground from the motorbike to damage the skull. It will be just one instance of a speedy ride spinning out of control. It will be just one instance of the underage driver panicking.  Whether in the case of the bus tragedy, or in the case of Mr. Mistry, on the fateful day, it was a split second that turned everything topsy turvy!

And when the moment arrives, it is too late to take evasive action or to make any correction. Extra caution is required to curb the optimism bias, for things can turn topsy turvy in a split second!

Risk Perception and Tolerance

Risk perception is the ability to discern risk, and risk tolerance is the capacity to accept a certain amount of risk ( we often use the term “calculated risk” ).

There is an interesting correlation with the age of the driver. Younger drivers are overconfident because they underestimate the hazard or do not anticipate it. This is due to inexperience. On the contrary, the experienced drivers underestimate the risks because some of them are familiar! Or, as discussed earlier, the repeated experience blunts the sense of risk and exaggerates the sense of control.

It is known that men take more risks on the road compared to women drivers. This is primarily because the risk tolerance levels of women are lower, and there is a strong correlation to the family affiliation.  Thrill seekers have a very high risk tolerance, and they knowingly engage in extremely risky behaviour.

What Can We Do About It?

We need safer systems – safer roads, safer vehicles, safer speeds – that will be more forgiving to human errors. But there is no substitute to a safety mindset – safety is not by accident.  As my friend Naresh Raghavan ( the author of the Card Driving School Manual for India ; he has recently released his course online for free Indian Driving Rules (Professional Road Safety Course) – YouTube ) says “Driving may be fun. But primarily it is a huge responsibility. A well-trained driver can drive safely through bad roads, bad traffic conditions, bad weather. Good driving is science, don’t leave it to luck”.

The awareness that the road is a shared space, and that we all should be able to continue to enjoy our driving or walking is essential to reduce risky behaviour. Perception of risk is a critical antecedent to at-risk road behaviour. Conventional defensive driver training should be augmented with training to increase self-awareness so as to improve technical driving skills without increasing overconfidence.  We suggest the use of toolkits with a set of questions supplemented by videos and images. The drivers can do a self-assessment. Based on the answers, there can be a targeted sensitization. This will help temper their risk perception. The toolkit can also help draw a stronger connection to family and community so that they feel the need to avoid the negative consequences and thus lower their risk tolerance. Fleets ( trucks, buses, taxis ) should certainly implement this on a regular basis.

“Catch them young!” – The sooner we do this in the life of a driver, the better it is.  This can be incorporated into the process to grant a driving license, and then at each renewal to help the driver re-calibrate.

If you have any suggestions, I would love to hear from you!

References

1. https://www.indiatoday.in/india/story/nitin-gadkari-seatbelts-mandatory-for-passengers-in-rear-seats-of-car-cyrus-mistry-accident-1997204-2022-09-06
2. https://www.mid-day.com/mumbai/mumbai-news/article/the-v-and-l-on-the-road-that-claimed-cyrus-mistrys-life-23244463
3. https://www.india.com/karnataka/8-dead-20-injured-after-bus-carrying-60-passengers-overturns-in-karnatakas-tumkur-5292865/
4. https://www.thecampbellinstitute.org/wp-content/uploads/2017/05/Campbell-Institute-Risk-Perception-WP.pdf
5. https://iosh.com/media/5929/presentation-by-tina-on-risk-perception-to-safe-behaviour.pdf

In our last post, we analysed the clickbait in phishing emails. In this article, we look at the 2nd part of cyber safety, Vishing and Smishing.

Vishing is voice phishing, the tactics that lead to sensitive information being obtained via phone calls. And Smishing is short for SMS phishing, when an ordinary looking SMS has a hook that snares the victim and leads him to share sensitive information. The prevalence of this phenomenon led to the creation of the series Jamtara – Sabka Number Aayega which dramatised some true stories.

Often, the fraudster poses as a person with some authority – from the bank, from the government, from the police, from the workplace, etc. – and the victim is convinced that it is right to share the information. People may be wary of another person calling with such authority, but there are other occasions where greed or fear lead to an error. Let us see some examples.

Vishing – Case 1
Mani put up a car for sale on an online website. He posted a few nice pictures of his car along with the expected sale price, and his phone number. Later in the day, he got a call. 
“This is Colonel Rajendran. I am a ex- army officer, now in civil service after 18 years in the army. As an army man, I like dealing with honest people, so I am happy that you have posted about the small accident you had. I am keen to purchase it”.
Mani was very happy. He asked the Colonel to come over and check out the car.
The Colonel said, “For sure, I will do so. But I want to reserve the car. Hence, I want to pay you a token amount up front. I will transfer Rs 50,000.”
On the Colonel’s request, Mani shared the bank details to transfer the money.
While still on the call, the Colonel transferred Rs. 100 to Mani. “It was a trial transaction. I will now transfer the Rs 50,000”, he said, keeping Mani engaged on the call. A little later, he told Mani, “Since the amount is a bit high, the bank wants me to share a QR code for your authorization. I will share it on your email, and you can scan it with your banking app”.
Mani shared his email, and in a moment, he received the QR Code via an email that from col_rajendrann. Following the Colonel’s instructions, Mani opened his usual mobile banking app, and scanned the QR code. “I am approving it”, he told the Colonel. As soon as he had approved it, the phone got disconnected. Mani then noticed an SMS that his account had been deducted for Rs 50,000.

Note the modus operandi of the fraudster. He builds trust posing as an ex-army officer, and appealing to Mani’s honesty. And he keeps Mani distracted with his conversation while he sends the QR code. What did Mani miss? If you have paid using QR code in shops, you will realise that it identifies the entity receiving the money, and may embed the amount in it as well. The QR code is scanned by the person who pays, and not by the person who receives the money! This small detail would have alerted Mani.

Vishing – Case 2

Payal got a call in the afternoon. “Hi, this is Surya from xxxx.com. Am I speaking to Payal Sharma?”. Payal confirmed. Surya’s voice was very enthusiastic, ”We recently held a lucky draw for our regular customers. I am happy to say you are one of the lucky winners! One amongst 10 lac! The prize is a gift coupon worth Rs 20,000! Congratulations!” Payal was very excited. She had never been so lucky before. Surya said, “I need to verify a few details to ensure that we are indeed sending it to the right Payal Sharma. Can you confirm your first name, last name, and your address?”. Payal did so.

Surya then said, “Our database says that you have used a Credit Card for your purchases. Can you confirm the card details? Your card number, expiry and CVV should match our records”. Payal went ahead and shared that as well.
Surya said, “Thank you for your patience. All the details have verified OK. I am now going to initiate the process for the dispatch of the gift card. You will receive an OTP, once you confirm the same, the delivery will be completed.”
The next second, Payal received an OTP. She opened it, her eyes registered Rs 20,000 and xxxx.com. She read out the OTP.
Surya said, “Thank you. The gift card is on its way!” and cut the call.
Immediately after that, Payal noticed that her account had been debited by Rs. 20,000.

Note the modus operandi. The fraudster has dangled the carrot of a free voucher, appealing to the basic greed. Again, the fraudster is keeping her distracted, and creating a sense of urgency to share the OTP. In the process, Payal does not pay full attention to the OTP.
Here is a typical OTP one may receive for transactions:

Note the specific mention that it is for a transaction, i.e. a Purchase! And that the purchase is on MMM merchant. Also, it explicitly ask the user not to share the OTP.

Smishing – Case 1
It was the month of March. There had been many reminders requesting PAN number to be linked with Aadhar. In the last week of March, Dinesh received an SMS

Dinesh was alert. He recognized this as a Smishing attempt. What did he see?
He checked that the SMS was sent from phone number 079854xxxxx. A bank will never send messages from a personal phone number. By regulation, such messages have to be sent using a registered identity so you will see the receiver being VM-AxisBk or AD-SBI, etc.
He noticed that the language was not refined and it had errors. Most importantly, Dinesh was sure that the bank will never solicit such KYC information on its own. KYC does not get “suspended”. He ignored the SMS as a fraud message and carried on.

Smishing – Case 2
In the same period, Paul got a SMS :

Paul was cautious, but curious. He called the customer care number listed. He heard the usual recorded message that AAA Bank played. Then the agent picked it up. “Hi, thank you for calling AAA Bank. This is Sunita. How may I help you?” When Paul asked about the message he had received, Sunita told him “Let me check.”, and after a pause, she said, “This is quite common, so the bank has created an app to help customers. I will share a link with you. You can download the program and do the KYC details yourself”. The call ended, and Paul received a link on his mobile.  

At this time, Paul became suspicious, and decided to do a further check. The SMS had come from phone number 63834xxxxx, so not a genuine message from the bank. Wisely, he chose not to click on the link.

This is an example of a clever attempt (and a 2-step mechanism) to get victims to download malware onto their devices. The malware can then capture lot of sensitive information, and relay back to the fraudster.

Higher level of Security with 2FA and MFA
The two-factor authentication (2FA) in India provides a second line of defence even when certain sensitive information is compromised. 2FA brings two elements together:
* Something you know : eg. Password, PIN, Credit Card details, etc
* Something you have : a mobile device where the OTP gets delivered; a chip card in your hand

Thus, even if card details etc are shared, unless the transaction OTP is shared, the authorization is incomplete.

Stronger authentication mechanisms include “something you are” e.g. biometric, so no one else can impersonate you.  Other factors include Location and Time.
Multifactor authentication (MFA) uses 2 or more factors to further strengthen the security.

Be(a)ware!
There are many other examples – impersonating your friend, fake job portals, fake tech support, fake covid testing / vaccination sites, fake loans, fake insurance offers – the list of fraudsters is long. But luckily, we have a short list of precautions!
Whether it is phishing, vishing, or smishing, remember that
* The fraudsters will play on your psychology – greed, or fear
* They will speak with authority, with practised ease that wins your confidence, and create a sense of urgency
* They will entice you to share the 2nd element of the 2FA – the OTP – that will complete the transaction.

Remember
* Scan a QR code only when you want to pay a merchant
* Check the OTP message to confirm it is triggered by your action for purchase or registration. Do not share any OTP
* If in doubt, check directly with your bank or the said authority
* Set your transaction limits to contain the loss in case of any such event

* In an unfortunate event, if you face such a situation, report it to the nearest Cyber Crime Police Station and National Cyber Crime Reporting portal at https://cybercrime.gov.in

**********************************************************************************************

Image Credits
www.whatismyipaddress.com
blog.credo.com
www.kaspersky.com
www.avatier.com