Learners must prove who they are, with their current password, before they can change their email address or password.
Why this matters
Imagine a learner signs in on a shared or public computer and walks away, or leaves their laptop unlocked. Without this protection, anyone who sits down could open the profile page, change the email address to their own and then reset the password, taking over the account for good. Asking for the current password stops that, because a passer-by does not know it. Asking the new address to be confirmed stops anyone from pointing an account at an email they do not control.
What changes for learners
Changing an email address
On the profile page, the learner enters the new address and their Current Password. The change does not take effect straight away. We send a verification link to the new address, the page says "Check your new email address for a verification link. The change will not take effect until you confirm.", and the old address stays in use until the link is clicked. The link expires after 24 hours. We also send a notice to the old address that a change was requested, so the real owner can spot an attempt they did not make.
Changing a password
The learner enters their Current Password as well as the new password and its confirmation. If the current password is wrong, the change is refused with "The current password you entered is incorrect."
Learners who sign in with single sign-on
People who sign in through your identity provider (single sign-on) cannot change their email or password themselves. Those fields are read-only and show Managed by your identity provider. Changes for these learners are made in your identity provider, or by an administrator.
How to get this
This feature is included in your plan. Ask us to switch it on and we'll enable it for your site, usually within 1 business days. Tell us if you'd like it on a test site first.