Case File

As Nova continued exploring life on Earth, she noticed that many students enjoyed sharing photos, artwork, and fun moments with friends on a popular youth social app called PicShare. They followed each other, liked posts, and chatted through direct messages every day. One afternoon, Nova decided she wanted to create her own account.

Her friend Maya smiled and said, “You should join! It’s a great way to stay connected with everyone and share your drawings I see you do in class.”

Nova was excited! She had never made a social account before, but thought it was a cool way to share her artwork, see other people’s posts and stay connected through sharing images.

She chose a username, uploaded a profile picture, and started setting up her account.

The app asked Nova to create a password. Not wanting to forget it, Nova used the same password she had already used for several other accounts.

Password: Nova123

Next, the app asked if she wanted to turn on Two-Factor Authentication (2FA) to help protect her account. It explained that if someone tried to sign in from a new device, Nova would receive a special verification code before they could access her account. Nova thought for a moment, but she was too eager to get her account created and start posting.

“That sounds like an extra step. I’ll skip it for now.”

The app also suggested adding recovery information and turning on security notifications in case there was unusual activity on her account. Nova skipped those options too. “I can always set that up later,” she thought.

For the next few weeks, everything seemed normal. Nova shared photos of her artwork, sunsets, and her pet. She enjoyed chatting with classmates, commenting on their posts, and seeing what everyone else was sharing.

Then one Saturday morning, her phone started buzzing with notifications. Her friends were sending messages.

“Nova… did you mean to post that?”

“Why did you send me that strange link?”

“I think someone might have gotten into your account!”

Nova’s heart raced. She opened PicShare and froze. There were posts she had never uploaded. Her profile picture had been changed. Several of her friends had received strange messages from her account asking them to click unknown links.

When Nova tried to log in to fix everything, her password no longer worked. Someone had changed it. She was locked out of her own account.

Nova couldn’t understand how it had happened. She had never shared her password with anyone, so how could someone else have gotten into her account? She began thinking back to when she first created her account, wondering if there was something she had overlooked that made it less secure.

Feeling worried, Nova immediately sent an emergency transmission to you, one of her Digital Ambassadors.

“Digital Ambassadors, I don’t know how someone got into my account! I never told anyone my password, but now someone is pretending to be me and sending strange messages to my friends. How could this have happened? Can you help me figure out what went wrong and how I can better protect my accounts in the future?”

Your Mission:

Help Nova investigate what happened to her account. Work together to identify the security choices that may have made her account more vulnerable, learn how stronger passwords and account protection features can help keep accounts secure, and give Nova advice for protecting her online accounts in the future.