How to trace a leaked course video back to the student who shared it
Read the visible watermark, have your platform check for an invisible one, then confirm the account against viewing records. Keep the evidence and treat the student fairly.
On this page 8 sections
To trace a leaked course video, start with the copy itself and read any visible watermark showing a student's name or ID. If it has been cropped or blurred, ask your platform to check for an invisible watermark that identifies the account. Then confirm the lead against your account records: when that account watched the leaked lectures, and from which devices. A trace identifies an account, not always the person who leaked, so keep the evidence and give the student a fair hearing before you act.
What a trace can and can't tell you
A good trace answers one question well: which account did this copy come from? Sometimes it also tells you which lecture was copied and roughly when. That is usually enough to stop the leak, because the account is what you can suspend.
A trace can't tell you on its own:
- Who was holding the phone. A sibling, a friend sharing the login or someone with a stolen password looks the same as the student.
- Whether it was deliberate. A student may have shared a login without imagining it would end up on Telegram.
- Who is selling it. The person running the channel may have bought the copy from someone else, several steps removed from the account.
- Whether the account belongs to a student at all. Staff, demo and test accounts leak too, so check whose account it is before assuming.
So the goal is a strong lead, backed by records, followed by a fair process. Each step below builds one part of that.
Step 1: get the best copy you can
Everything depends on the copy you start from. Where you can lawfully do so, download the actual video file from the channel, drive or site, not just a screenshot. Where several copies exist, keep the earliest and the highest quality you can find. Re-uploads are often cropped or compressed differently, so one may show more of the mark than another.
Don't trim, convert or compress anything. Store the originals unchanged, work on copies, and record where and when each file was found. Record the earliest time you can establish for each copy, such as the date on the channel post, not just when you found it. Note what the leak contains, too: which lectures, which batch and which dates. That list is evidence in itself, as Step 4 shows. Our guide to preserving digital evidence of a leak explains hashing and the certificate a court may need.
Step 2: read the visible watermark
A dynamic watermark moves around the screen, so look at many points in the video, not one. Pause on frames where it appears, zoom in and take a screenshot of each, noting the time in the video. A partial name in one frame and the last digits of a phone number in another can add up to one account.
Check the result against your batch list. Names repeat, so a student ID or roll number is the stronger match. If the mark has been deliberately cropped, blurred or covered, note that too. It suggests the copy was prepared for sharing, and it tells you to move to Step 3. Our guide to dynamic watermarking explains the usual ways visible marks get hidden.
Step 3: check for an invisible watermark
Invisible watermarks are hidden in the picture and can't be read by eye. You send the leaked file to your platform, and it checks the copy for an identifier that matches an account. Because there is nothing visible to crop, this is often the only route left when a pirate has removed the visible mark.
- Send the whole file, not a clip. Invisible marks are generally easier to read from more footage.
- Send the best copy, not one you have re-saved or forwarded through a messaging app.
- Ask for the result in writing: which account, which lecture and how confident the match is.
Don't contact the suspected student or the channel while you wait. A warning at this stage can lead to a cleaner copy, a new account or deleted evidence.
Our guide to visible and invisible video watermarking covers what to expect from each kind of mark.
Step 4: confirm the lead against account records
A watermark gives you a lead; your records test it. These are the most useful checks:
| Record | What to look for | Caveat |
|---|---|---|
| Viewing history | Did this account watch every lecture in the leak before the leak first appeared? | Many honest students watch everything |
| Release timing | For example, a lecture released at 7 pm and leaked by 9 pm: who watched in between? | Narrows the list; doesn't prove anything alone |
| Devices | New devices, many devices, desktop browsers or emulators | Students change phones honestly |
| Locations and IP addresses | Logins from distant cities close together | Mobile networks often share one address among many users, and VPNs move people around |
| Account changes | Password resets or phone number changes just before the leak | Can mean the account was taken over |
| Batch membership | A leak mixing lectures from two batches points to an account in both | Staff and demo accounts may also have both |
If the copy carries no mark at all, the records still help, but look at your side doors first. An unmarked, full-quality copy often points to a download link, an old app version, a preview or a raw file, rather than a student. In that case, the people with access to the originals come first.
The strongest cases combine both kinds of evidence. A mark that names an account, plus viewing records that fit the leak's contents and timing, is far more persuasive than either alone.
Evidence to keep
Keep a single folder for each leak, so nothing has to be rebuilt later:
- the leaked files, unchanged, with their hash values and where and when each was found;
- screenshots or a screen recording of the channel, post or page, showing dates and any price;
- frames showing the visible mark, with their times in the video;
- your platform's written result for any invisible watermark;
- an export of the account's logins, devices and viewing history for the relevant period;
- the version of your terms of use the student accepted, and when;
- every message to and from the student, and a note of what you decided and why.
If you later go to the police, our guide to filing a cyber crime complaint shows how this file is used.
Handling the student fairly
A trace that's handled badly can hurt an innocent student and your reputation at once. A simple, consistent process protects both:
- Suspend, don't delete. Suspending access stops the leak and keeps every record intact.
- Write to the account holder, and to a parent if the student is a minor. State what was found, which lecture and when, without accusing, and ask for an explanation by a set date.
- Listen for innocent explanations. A shared family phone, a lost phone or a stolen password are real possibilities. Check the records for signs that support or rule them out.
- Decide under your written terms. Options range from a warning and a device reset to suspension for the batch or ending the enrolment, with any refund handled as your terms say.
- Be consistent. The same finding should lead to the same outcome, whoever the student is.
- Keep it private. Don't name the student in batch groups or on social media. You might be wrong about who was holding the phone, and many students are minors.
- Escalate only when it's commercial. For someone selling your course or leaking repeatedly, speak to a lawyer about a legal notice or a police complaint.
Then tell all students, without names, that a leak was traced and the account suspended. It shows students that tracing is real, not just a clause in your terms. This is general information, not legal advice.
VidSafe adds visible and invisible watermarks that are extremely hard to remove, even after heavy re-encoding, so a leaked copy can be traced back to the account it came from. It also brings VidSafe proprietary encryption, screen- and camera-recording detection, account-sharing prevention and PDF watermarking. See Upclass plans and pricing.
Frequently asked questions
Can you find out who leaked a course video?
Often, yes, if the video carried a watermark. A visible mark may show the student's name or ID, and an invisible one can be read by your platform even if the visible mark was removed. Account records then show when and where that account watched. A trace points to an account, which may not be the person who leaked.
Can a watermark be traced if the video is cropped or compressed?
A visible watermark may be lost if it is cropped, blurred or compressed until unreadable. Invisible watermarks are designed to survive this kind of damage, and well-designed ones stay readable after heavy re-encoding and screen recording. Always give your platform the best, most complete copy you can find.
Can I take legal action against a student who leaked my course?
Yes. Sharing a course without permission infringes copyright under section 51 of the Copyright Act, 1957, and knowingly doing so is an offence under section 63. For most single leaks, suspending the account under your terms is quicker and proportionate; legal action suits commercial resale or repeat leaks. This is general information, not legal advice.
What if the student says their account was shared or hacked?
Take it seriously and check the records. New devices, distant logins or a password reset just before the leak can support the claim. Even so, your terms can make account holders responsible for keeping their login private. A shared account can then still be suspended, ideally with a clear warning the first time.
