Misuse of student identity

Understanding what may have happened

The right response depends heavily on what “someone using your student identity or university account” actually means, because very different situations flow from it. It is worth being precise, because the facts change both who you should report to and whether any wrongdoing has occurred.

Common scenarios include someone logging into your university email, virtual learning environment or student portal without permission; someone submitting or altering academic work under your name; someone sitting an examination or online assessment as you, or arranging for you to sit theirs; someone using your student status, enrolment details or student finance information to obtain money, credit, discounts or benefits; or someone using your name and account to send messages, harass others or access university systems.

Before treating this as a crime or serious misconduct, it is worth ruling out innocent explanations. For example, shared login details, a housemate or family member using a device you left logged in, an IT or administrative error, or automated single sign-on caching can all look like unauthorised access. Where genuine unauthorised access, impersonation or fraud has occurred, several distinct legal and procedural routes may apply at the same time.

Immediate practical steps

1. Secure your accounts straight away. Change your university password and the password of any linked account, especially your personal email, and turn on multi-factor authentication if it is available. If you reused the same password elsewhere, change it there too.

2. Contact your university IT service desk immediately and ask them to log the unauthorised access, check for a compromise, and review recent login and activity records. University IT teams can often see login locations, times and what was accessed, which is valuable evidence.

3. Preserve evidence before anything is deleted. Take dated screenshots of suspicious emails, submissions, messages, login alerts, account activity logs and any changes made to your work or profile. Note dates, times and anything you know about who may be responsible. Do not delete the offending material, as you may need it.

4. Notify the relevant university department in writing. Depending on what happened, this may be the IT security team, your school or department office, the examinations or academic registry team, or the student conduct or academic integrity office. A written report creates a clear record and starts any internal process.

If your identity was used for academic work or an exam

This is treated very seriously by universities. Impersonation in an assessment, false authorship, and submitting work as if it were someone else’s are specific categories of academic misconduct in the disciplinary regulations of institutions in England and Wales, and they can lead to severe penalties including failure or expulsion for the person responsible.

The important point for you is to report it promptly and proactively, so that you are recorded as the person who raised the concern rather than a suspect. If someone submitted work under your name, or logged into an assessment as you, tell your academic integrity or misconduct officer at once and provide your evidence. If you have been accused of misconduct because of something done through your compromised account, respond to the process, explain clearly that your account was accessed without authority, and rely on the IT login records and any other evidence. Universities usually have set procedures and, crucially, short internal deadlines for responding to allegations and for appealing decisions, so do not delay. Read the specific allegation letter and follow the time limits it sets.

You should also be careful about one point. If you knowingly allowed someone to impersonate you, sit your assessment, or use your account to submit work, that is itself misconduct on your part and potentially a criminal offence under fraud legislation. Genuinely being a victim of unauthorised use is very different from consenting to it, and you should be honest with yourself about which situation applies before you frame it as identity misuse.

If it involves fraud, money, or your personal identity

Where someone has used your student identity or account to obtain money, credit, a loan, student finance, discounts, goods or services, or to access your bank or personal accounts, this can amount to criminal offences. Unauthorised access to a computer system is an offence under the Computer Misuse Act 1990, and using a false identity or your identity to make a gain or cause a loss can amount to fraud under the Fraud Act 2006. Identity theft used to commit fraud is a matter for the police.

In England and Wales, financial fraud and cybercrime are reported to Action Fraud, the national reporting centre, either online or by phone, and you will be given a crime reference number. If you are in immediate danger, or the offender is known and there is an ongoing threat, call the police on 999, or 101 for non-urgent matters. Keep the reference number, as banks, Student Finance England, the university and credit providers will often ask for it.

If bank accounts, cards or Student Finance have been affected, contact those organisations directly and without delay to freeze accounts, dispute transactions and flag the fraud. You can also consider a protective registration with Cifas, the UK fraud prevention service, which places a warning on your credit file so lenders carry out extra checks before opening accounts in your name. Check your credit report through one of the main credit reference agencies to see whether anything has been opened fraudulently.

If it involves harassment, offensive messages or data

If your account was used to send abusive, threatening or harassing messages, or to access or share other people’s personal data, this may engage the Protection from Harassment Act 1997, the Malicious Communications Act 1988, or communications offences, as well as data protection law. Report it to the university and, where appropriate, to the police, and make clear which messages were not sent by you. If personal data held by the university has been exposed, the university has its own data breach obligations and you can raise a concern with the Information Commissioner’s Office if it is not handled properly.

Reporting to the university and possible outcomes

A clear, factual written report to the university should set out what happened, when you discovered it, what evidence you hold, and what you are asking for, for example confirmation that no misconduct will be recorded against you, correction of any tampered work, and an investigation of the person responsible. Ask the university to confirm in writing what action it will take and by when.

Universities generally have a two-stage internal process for complaints and for misconduct, and if you exhaust the internal process and remain dissatisfied you can usually ask the Office of the Independent Adjudicator for Higher Education to review the university’s handling of your complaint. The OIA looks at whether the university followed its own procedures fairly, not at the underlying criminal issue.

Protecting yourself going forward

Once the immediate risk is contained, review where else your credentials may be exposed, enable multi-factor authentication everywhere it is offered, avoid reusing passwords, and be alert to follow-on phishing that often targets people once an account has been compromised. Keep a simple dated log of everything you report and every reference number you receive, because you may need to demonstrate that you acted promptly and in good faith.

Key facts that would change the answer

The most useful next detail is exactly what was done with your identity or account, since that determines the correct route. Whether the access was genuinely without your consent, whether any financial loss occurred, whether academic work or an examination is involved, whether you have been accused of anything, and whether you know who was responsible will all materially affect both the legal characterisation and the most sensible order of steps. If you tell me which of these applies, I can give more targeted guidance on procedure, deadlines and remedies.