How a Real-World Incident in Uttarakhand Inspired Me to Build a Secure School Management Portal

Some projects start with an idea. Others start with a real-world problem.

I recently completed my B.Tech in Computer Science at Graphic Era Hill University. During my final year, I wanted to build a project that wasn't just about writing code, but also had a practical purpose behind it.

In 2025, during a discussion with a teacher, I learned about a cyber fraud incident that happened in Dehradun, Uttarakhand, back in 2023.

A school manager lost ₹95,000 after following instructions from a fraudster and opening some malicious links.

That story stuck with me. It made me think about how important security is in school management systems, and that's how I got the idea to build my Secure School Management Portal.

In this article, I'll share the incident that inspired me, the security features I built, the tech stack I used, and what I learned along the way.

The Real-World Incident That Inspired Me

In March 2023, a school manager named Shambhu Prasad Pancholi was reportedly cheated out of ₹95,000 in a cyber fraud incident in Dehradun.

According to a Times of India report, here's how it happened:

1. A Fake Parent Called the School Manager

The manager got a call from an unknown person pretending to be the father of a student named Piyush. The caller said he wanted to pay his son's pending school fees online. Since a student with that name actually did have outstanding fees, the manager trusted the caller.

2. The Fraudster Sent Four WhatsApp Links

Instead of asking for an OTP, the fraudster sent four different links to the manager's WhatsApp. He was told to open these links to "complete" the fee payment.

3. ₹95,000 Was Taken From His Account

Once the manager opened the links, the fraudsters gained unauthorized access and made four separate transactions — taking a total of ₹95,000 straight from his bank account, without ever needing an OTP.

This incident showed me how a simple-looking payment request can cause real financial damage. It also made me think about how schools handle student data, fee payments, and other sensitive information.

I started asking myself:

• Can I build a school management system that focuses not just on managing school activities, but also on security?
• That question became the starting point of this project.

Why I Built the Secure School Management Portal

I wanted to build something that could handle everyday school tasks — fees, records, and communication — while also protecting user accounts and sensitive data. My goal was to apply what I'd learned in web development and see how different security layers work together in a real application.

This is a personal learning project inspired by the incident. It wasn't built for the school involved in the actual case, and I'm not claiming it would have stopped that exact fraud from happening.

What I Built

The Secure School Management Portal is a web app with separate portals for admins, teachers, and students. It includes school management features, fee management, user authentication, access control, security monitoring, and deployment tools.

Rather than relying on just one security feature, I focused on building multiple layers of protection into the app.

Security Features I Implemented

A quick note before diving in: these features are designed to reduce certain risks and add layers of defense — none of them are a guarantee against every possible attack, and none of them can protect a user's personal bank account from a scam that happens outside the app.

1. Multi-Factor Authentication (MFA)

MFA adds an extra verification step for protected in-app actions. Even if someone steals a password, this extra layer makes it harder for them to log in. My project includes MFA/2FA for supported operations — though it only protects actions within the app itself, not a user's external banking or personal accounts.

2. Role-Based Access Control (RBAC)

Admins, teachers, and students each get different levels of access. Admins can manage records and fees, while teachers and students only see what's relevant to them. This helps reduce the chance of someone accessing information they shouldn't.

3. JWT Authentication and Session Management

I used JWT for authentication and to protect routes. The project also handles role-based token expiry, session tracking, expiry warnings, and automatic refresh — all of which help lower the risk of someone misusing an old or stale session.

4. Password Hashing with bcrypt

Passwords should never be stored as plain text. I used bcrypt to hash every password before saving it, which helps protect user passwords if the database is ever exposed.

5. Anti-Phishing Protection

The app checks for suspicious domains, verifies origin and referer headers, and looks for phishing-style patterns. These checks can catch some suspicious requests, but they can't stop every malicious link sent through WhatsApp, SMS, or email, and they can't protect someone's personal bank account from a scammer.

6. Web Application Firewall (WAF)

The WAF looks out for patterns tied to SQL injection, XSS, and command injection attacks. It's one more layer of defense to help reduce risk — not a guarantee that every attack gets blocked.

7. Intrusion Prevention System (IPS)

After five failed login attempts, an IP address gets blocked for 15 minutes. This helps make brute-force password guessing more difficult.

8. Anomaly Detection System (AD S)

The system flags unusual behavior, like:

• Fetching more than 50 records at once
• More than 10 requests per minute
• Bulk operations

These flags help surface usage patterns that might need a closer look — they don't automatically block or resolve anything on their own.

9. AES-256 Data Encryption

Sensitive data — names, emails, phone numbers, addresses — is encrypted at rest using AES-256-CBC. This adds a layer of protection for stored data, though encryption alone doesn't cover every possible way data could be exposed (for example, if an attacker gains access through a different vulnerability).

10. Security Logs and Notifications

Security-related events get logged, and the app can send alerts through Email, Slack, Discord, or Microsoft Teams. This makes it easier to spot and investigate suspicious activity after the fact.

Making School Fee Payments More Secure

Since the incident that inspired this project involved a fake fee payment request, I paid extra attention to the fee management workflow. It includes:

• Razorpay Integration — online payments with order creation and signature verification
• Email OTP Verification — for supported Razorpay and manual payment flows within the app
• Manual Payment Approval — UPI and bank transfers need admin sign-off
• Payment History — a full record of past transactions
• Digital Receipts — for every successful payment
• Fee Assignment — admins can assign fees with descriptions and due dates

Payment signature verification helps confirm that a transaction processed through the app is genuine, and OTP verification adds a checkpoint to supported in-app payment flows. But here's the catch: none of this protects someone's personal bank account if they open a malicious link outside the app, the way it happened in the real incident.

That's the biggest lesson from this whole project: security has to cover the entire process, not just the login page or the payment form.

My Tech Stack Monitoring and Deployment

Beyond just writing app code, I also explored deployment and monitoring. I used Docker and Docker Compose to run everything in containers, and added Prometheus, Grafana, and Node Exporter for monitoring.

I also set up the groundwork for a Jenkins pipeline to support CI/CD in the future — it's not a fully working automated pipeline yet, but structuring it gave me a solid understanding of how deployment workflows are organized.

Challenges I Faced

The biggest challenge was getting all the pieces to talk to each other — authentication, role-based permissions, database logic, fee management, and the frontend all had to work together smoothly. Adding security features without making the app clunky to use was another balancing act. Setting up Docker and the monitoring stack was a learning curve too, but it pushed my debugging skills a lot.

What I Learned

This project taught me that security isn't just a login page and a password field. I learned the value of:

• Layering multiple defenses instead of relying on one
• Managing access by role
• Protecting sensitive data at rest
• Adding checkpoints to in-app payment flows
• Watching for unusual activity
• Logging security events properly
• Thinking about real risks, not just textbook ones

Most of all, I learned that a real-world problem gives a project real purpose — and that being upfront about what a system can't do is just as important as showcasing what it can.

Explore My Project

🔗 Secure School Management Portal — GitHub Repository

Live Demo

You can use these credentials to explore the admin dashboard and test the portal's features.

Demo Admin Login: Username: admin Password: admin@123

Feedback, suggestions, and ideas are always welcome!

Final Thoughts

The ₹95,000 cyber fraud case in Dehradun made me take security in school systems a lot more seriously. As a 2026 graduate, I'm still learning and sharpening my skills, and this project gave me a real chance to apply what I know.

My goal wasn't to build just another CRUD app — I wanted to understand how a school management system could be designed with security as a core part of it, not an afterthought.

No application can guarantee complete protection against every attack, and this one is no exception. There's always more to learn, test, and improve — this project is just one step in that journey.

What additional security features would you add to a school management system to help protect against phishing and payment fraud? I'd love to hear your thoughts!

Originally published at https://dev.to on September 20, 2026.