The user ID for each school to log into a government portal to upload students’ data contains its DISE (District Information System for Education) code followed by the digits “32”.

All the schools were given a common, easy-to-guess password which they were asked to reset after logging in for the first time, police officers investigating the “tab scam” said.

The majority of the schools whose plus-II students did not receive the government funds intended for them to buy tabs or smartphones had not reset the password and uploaded data from cyber cafés, making the system vulnerable to breach, the officers said.

“We have learnt from the school education department that all schools were advised to change the password after logging in for the first time. But most of them did not,” said a senior officer probing the scam.

The school education department, under the Taruner Swapna scheme, transfers ₹10,000 to the bank accounts of all plus-II students in government and government-aided schools every year so they can buy smartphones or tabs for digital learning.

This year, however, the money meant for thousands of students across the state has landed in the bank accounts of unauthorised persons, with the police suspecting manipulation of data by a racket.

The user IDs for the schools are the DISE code, which is unique for every government or aided school, followed by the digits “32”, an officer said.

“The password was a combination of alphabets. numbers and a special character,” said the officer.

Sources said the common password for all schools was “school@2***” (the password is not being mentioned in full for the sake of the investigation).

At least 2,000 students across the state have fallen prey to the fraud, the police said.

The Bengal police have received complaints from 1,911 students till Friday. More than 100 students have complained in the Kolkata Police area.

Around 16 lakh students in the state are entitled to the grant.

The police said on Friday that Bengal is not the only state where swindlers have targeted direct cash transfer schemes.

“We have come across documents which show inter-state connections. These people (who have been arrested till now) were involved in multiple DBT (direct benefit transfer) scams in Maharashtra, Rajasthan and Jharkhand,” the additional director general of police, south Bengal, Supratim Sarkar, said.

A joint investigation monitoring team has been formed for all complaints related to the so-called “tab scam”.

Kolkata Police have started 10 cases in connection with the defalcation in their area.

A senior officer in the city police headquarters in Lalbazar said a preliminary inquiry has revealed that the data tampering was done “almost real-time” — soon after the schools uploaded the data.

“It appears that the swindlers accessed the accounts almost as soon as a school entered the data in a government portal. Once a school submits data, they are checked at the level of the school inspector or the district inspector of schools. Data cannot be tampered with at that level. They can be changed only when sent back to schools for rectification after scrutiny,” an investigator said.

“The majority of the data entry was done from cyber cafés and that made the system vulnerable,” the officer said.

Kolkata Police on Friday said the money earmarked for 42 students at a school in Jorabagan did not reach their accounts.

That money, the police said, has been traced to bank accounts in Bihar’s Kishangunge. “The accounts have been frozen,” an officer said.

As many as 33 students at a Sarsuna school have not got the money. 

A special investigation team led by the deputy commissioner of the detective department (special), Vidit Raj Bhundesh, visited the school education department headquarters at Bikash Bhavan on Thursday to find out how the students’ banking data was shared with the finance department.