The most common form of course piracy is not a hacker. It is one paying student and a WhatsApp group. Here is how to close it without making life hard for honest students.
Ask an instructor about course piracy and they picture someone downloading and reselling their videos. That happens, but it is not where the money goes. The money goes to the far more ordinary case: one person buys, and several people watch.
It is quiet, it produces no evidence, and nobody complains — the group is perfectly happy. You simply sell one seat where you should have sold several, and you never find out.
The people sharing a login are not hostile to you. They liked the course enough to recommend it. They just recommended it by forwarding a password.
That makes this loss unusually recoverable. Unlike a stranger who was never going to pay, everyone watching on a shared login already wants the course and already trusts it. Closing the gap does not require marketing, a discount, or a new audience — it requires the account to stop working for five people at once.
A device limit caps how many devices one account can be used on. It attacks sharing directly: a login circulating in a group hits the ceiling within days.
Set it to two or three. This is the number that matters, and it is worth getting right.
Always pair it with a reset path. Students genuinely replace phones and reinstall systems. Allowing a reset every few months — self-service or through support — removes nearly all legitimate friction while keeping the ceiling meaningful. Without one, the limit generates complaints, and a limit that generates complaints gets raised or turned off. That is the worst outcome of the three.
Some usage patterns are simply not producible by one person. A good platform notices those and puts the account in front of you.
The important design point is that it should surface, not act. An automatic ban on a pattern is how you lose a student who was travelling, or sharing a household connection, or replacing a broken phone. A short list of accounts worth a look, reviewed by a human who knows the course, gets this right almost every time.
Enforcement should be graduated, because the population you are enforcing against is mostly customers.
First: warn. A clear, non-accusatory message — this account has been used on several devices; access is for one student — resolves a surprising share of cases immediately. Many students genuinely had not thought of it as taking something.
Second: restrict. Lock the account to its current devices and require contact with support to add another. Friction, not punishment.
Third: ban. By this point the sharing is deliberate, and you are not losing a customer you were going to keep.
Skipping straight to a ban costs you the revenue, the relationship, and whatever that student would have said about you.
State the policy plainly at enrolment, in one line: your access covers up to three devices; contact us if you change your phone.
Two things follow from saying it out loud. Honest students know what to expect and never hit a surprise. And students who were going to share now know it is monitored — which stops a good share of it before it starts, exactly as a visible watermark does.
Do not bury the policy in the terms of service. A control nobody knows about only works after the fact; a control everybody knows about works beforehand.
Combined with watermarking, this closes the two leaks responsible for nearly all real revenue loss: the shared login and the anonymous copy. Everything else in the protection guide is refinement on top of those two.
Two to three is the sweet spot for most academies. A typical student uses a phone and a laptop, and sometimes a tablet. Allowing one device generates constant support requests from honest people; allowing five or more makes sharing effortless and the limit meaningless.
Let the limit apply automatically, but review anything flagged beyond it yourself. Automatic bans catch travelling students, shared household connections and replaced phones. A short list of accounts worth a look, reviewed by someone who knows the course, gets it right far more often.
Only if they are set too tight or cannot be reset. Students genuinely change phones and reinstall systems. A sensible policy allows a small number of devices plus a self-service or support-assisted reset every few months, which removes almost all friction while keeping the limit real.
Activity monitoring is what surfaces it — some usage patterns are simply not producible by one person. The useful thing is for the platform to put those accounts in front of you rather than acting on them, so a human who knows the course makes the call.
Most advice on protecting courses is either useless or dishonest. Here is what each control genuinely stops, what it does not, and the honest answer about the one attack nobody prevents.
A watermark does not stop copying. It stops anonymous copying — and that turns out to be most of the problem. Here is how to set one up so it actually deters.
The honest answer is no — not completely, not by anyone. But most recording is casual, and casual recording is very stoppable. Here is the line between the two.