UCAS personal ID hacking?

I got my firm choice confirmed on UCAS, but at the bottom there is an option to ‘decline my place’. So if someone knew my UCAS personal ID, could they use this to hack into my account with that information alone and reject my offer? Alternatively, could they email the university as me (not that they would know my email) and ask them to revoke my offer directly, or is it that when a firm choice is made unconditional, only the applicant can revoke it?

Sorry in advance - just assuming the worst right now.

Reply 1

DataVenia

Volunteer Team

Original post by SCQ

You can only use the "Decline my place" button if you have an unconditional firm offer (or if you missed your firm grades and therefore only have an unconditional insurance offer).

If someone attempted to impersonate you and emailed a university requesting that they revoke their offer, I would very much hope that they would ask you to do so yourself via the "Decline my place" button. Email is not secure and the "from" address can be easily spoofed.

Finally, your UCAS ID is not sufficient to access that button. You need to actually login to UCAS Hub, hence your password would need to have be compromised too.

Reply 2

Admit-One

Universities Forum Helper

This why unis use more than the ID to verify your identity before making any amendments.

Reply 3

mnot

Universities Forum Helper

Original post by SCQ

I got my firm choice confirmed on UCAS, but at the bottom there is an option to ‘decline my place’. So if someone knew my UCAS personal ID, could they use this to hack into my account with that information alone and reject my offer? Alternatively, could they email the university as me (not that they would know my email) and ask them to revoke my offer directly, or is it that when a firm choice is made unconditional, only the applicant can revoke it?
Sorry in advance - just assuming the worst right now.

If someone were to know both your ucas ID & password to “hack” in. However if this happened metadata would enable UCAS to track the device & location of login and the associated activity so UCAS & the university would almost certainly honour there offer regardless if you called up and explained.

But frankly no point worrying about a billion to one event.