How to stop account sharing in your online courses
How shared logins spread through roommates, group buys, resale and forwarded OTPs, why device limits and password changes fall short, and what to ask.
On this page 9 sections
Account sharing can't be stopped with passwords alone. A login bought by one student spreads through PG roommates, study groups and resellers on Telegram, and simple rules either leak or lock out honest students. To stop it, start by understanding how shared logins spread, where common controls such as device limits and OTP checks fall short, and what to ask your platform.
What account sharing costs an institute
A shared login is a leak that never shows up on Telegram. The whole batch material, live classes and test series are consumed by people who never paid, and nothing looks wrong in your dashboard except an account that watches a lot.
A worked example, with illustrative numbers: an institute sells a UPSC foundation batch at ₹18,000. Suppose 100 enrolled students each share their login with three friends in the same PG or study group. That's 300 unpaid viewers. Not all of them would have paid, but if even one in four would have enrolled, the institute has lost 75 enrolments, or ₹13.5 lakh, on a single batch. Sharing also skews your data: completion rates, test rankings and doubt-session numbers all describe people you don't know.
How shared logins spread
| How it happens | What it looks like | Why it's hard to spot |
|---|---|---|
| Friends and roommates | One student logs in on a roommate's phone or laptop | Looks like one student using two devices |
| Group buys | Several students split one fee and share the login | Usage looks heavy but not impossible |
| Resale | A login, or access to it, is sold in a Telegram group | Many people, many places, often at different times |
| Passing on login codes | The account holder forwards an OTP to a friend | Every login passes the check, because the real owner approved it |
| Watching together remotely | A student plays a lecture and shares their screen with friends on a video call | Only one device is ever logged in |
| Shared or public computers | A library or cyber café computer stays logged in | Several people, one device |
Most sharing starts small and friendly, which is why students rarely see it as piracy. Resale is different: it turns one paid account into a business that can put a complete batch in front of strangers. Our guide to how piracy hurts coaching institutes covers the wider damage.
What Netflix's crackdown shows
In 2023 Netflix changed how it handles sharing, around one rule: "A Netflix account is for use by one household." On 19 July 2023 it began emailing members in India who were sharing outside their household, as its announcement for India explains. People in the household can still watch anywhere, including while travelling.
Netflix says it works out the household from IP address, device IDs and account activity, and that it doesn't collect GPS data for this; see Netflix's household help page. Three things stand out for institutes:
- The problem is big enough that the largest streaming service rewrote its rules around it.
- No single signal proves sharing. Netflix combines several and still has to allow for travel and new devices.
- A clear rule comes first. Students can't be held to a limit nobody told them about.
Why common controls fall short
| Common control | What it's meant to do | Where it falls short |
|---|---|---|
| Changing the password | Cut off everyone who has it | The account holder simply shares the new one |
| Device limits | Cap how many devices can watch | Friends share the allowed slots, and strict limits lock out students who change phones |
| One stream at a time | Stop simultaneous viewing | Sharers watch at different times, and screen sharing on a call needs only one stream |
| OTP on new devices | Check the account holder is present | The account holder can forward the code |
| Location or IP checks | Spot use from different places | Mobile networks share addresses, and hostel Wi-Fi and travel cause false alarms |
| Signing out other devices | End sessions elsewhere | Some platforms can't end a session everywhere at once |
That last row is more common than it sounds. Whether a platform can sign a student out of every device immediately depends on how its logins are built, as our comparison of sessions vs JWTs for forced logout explains.
IP addresses deserve particular caution, especially for students on mobile data. Many mobile networks put large numbers of subscribers behind shared public addresses using carrier-grade NAT; the IETF even reserved a block of addresses for it in RFC 6598. So two strangers can share an IP address, and one student can change address several times a day moving between hostel Wi-Fi and mobile data.
The false-alarm problem
Real students break naive rules all the time. They switch phones after a repair, travel home for Diwali, watch on a sibling's laptop, or study in a library where fifty people share one connection. Rules that treat all of this as sharing punish the students who paid, generate support tickets and push some of them towards the pirated copy they were never going to use. Any control needs a way for a real student to explain, and a person at your end who can look at the account and reverse a decision.
Where watermarks fit, and where they don't
Account controls try to keep each login to one person. They don't stop a single paying student recording lectures and sharing the files. A visible dynamic watermark puts the account's details on every recording, but it names the account holder, not necessarily the person who leaked, which is exactly the ambiguity sharing creates. The two problems have to be tackled together.
Questions to ask your platform
- Can we set device limits and simultaneous-stream limits for each course or plan?
- How do students change devices, and how often can they do it?
- Are new devices verified with an OTP sent to the registered phone number?
- Can students see their own devices and sessions and sign them out?
- How does the system decide an account is being shared, and how does it avoid flagging hostel Wi-Fi, travel or a new phone?
- Can our support team see an account's devices and sessions, and reverse a block?
- Can the platform sign an account out of every device immediately?
- If a recording leaks from a shared account, can it be traced back to that account?
Key takeaways
- Account sharing is a silent leak: whole batches consumed by people who never paid.
- Logins spread through friends, group buys, resale, forwarded OTPs and screen sharing on calls.
- Password changes, device limits, stream caps, OTPs and IP checks each have a gap a determined sharer can use.
- Crude rules hurt honest students, so every control needs a human review and an appeal route.
- Sharing and recording are linked problems, so ask your platform about both.
VidSafe, the video protection built by Upclass, includes account-sharing prevention alongside dynamic watermarking, screen- and camera-recording detection and VidSafe proprietary encryption. VidSafe adds visible and invisible watermarks that are extremely hard to remove, even after heavy re-encoding, so a leaked copy can be traced back to the account it came from. See Upclass pricing.
Frequently asked questions
How does Netflix know you are sharing password?
Netflix says it sets an account's household based on IP address, device IDs and account activity, and that it doesn't collect GPS data to do this. Devices that keep watching from somewhere other than that household stand out against those signals. It doesn't need to see the password being shared; it looks at where, and on which devices, the account is actually used.
Can Netflix detect password sharing?
Not directly: Netflix can't see a password being passed on. What it can see is how an account is used, and it says it defines each household from network, device and activity information, so regular viewing elsewhere can stand out. Household members can still watch while travelling. It shows how hard the problem is: even Netflix relies on patterns, not proof.
What happens if you share your Netflix password?
Netflix's terms say the service is for personal, non-commercial use and may not be shared with anyone outside the household unless an Extra Member has been purchased, where that option is available. People outside the household are expected to get their own account, and Netflix has emailed members who share outside their household. Check its help centre for the current rules in your country.