Changing a grade on a school computer is a federal crime under the Computer Fraud and Abuse Act and, in nearly every state, a separate state crime as well. A first offense can carry up to five years in federal prison when the hack was done for financial gain, such as protecting a scholarship. On top of prison time and fines, expect restitution orders that can run into tens of thousands of dollars, expulsion or a revoked degree, and a fraud conviction that shows up on background checks for years.
Federal Charges Under the CFAA
The main federal law is the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. It applies to any “protected computer,” a term the statute defines broadly to include any computer used in or affecting interstate commerce or communication.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers Because school grading systems connect to the internet, they qualify.
Three CFAA theories tend to come up in grade-change cases. The first is simply accessing a protected computer without authorization and obtaining information from it, which covers logging into a grading portal you have no right to use. The second, and the one prosecutors reach for most often, is accessing the computer with intent to defraud and obtaining something of value, such as an inflated GPA that secures a scholarship or admission. The third applies when the intrusion damaged the school’s network or data, even unintentionally.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
If someone used stolen login credentials, a second federal statute can also apply. The access device fraud law, 18 U.S.C. § 1029, makes it a crime to knowingly use an unauthorized access device with intent to defraud when the conduct produces $1,000 or more in value, and it carries up to ten years in prison. A stolen faculty username and password used to inflate a GPA tied to scholarship money can meet that threshold. The same statute has a conspiracy provision, so anyone who helped plan or execute the scheme faces up to half the maximum for the underlying offense.2Office of the Law Revision Counsel. 18 USC 1029 – Fraud and Related Activity in Connection with Access Devices
State Charges Run on a Separate Track
Nearly every state has its own computer crime statute that operates independently of federal law. A person can face state prosecution, federal prosecution, or both for the same conduct.
State charges typically fall into a few categories. Unauthorized access covers simply entering a protected system without permission, no matter how the entry was achieved. Computer tampering focuses on altering data within the system, which is what changing a stored grade is. When the altered record is used to obtain an unearned benefit like financial aid or a diploma, prosecutors may escalate to computer fraud, which adds a deception-for-gain element. Many states also treat digital alteration of an official record the way they treat forging a paper document, because their forgery and falsification statutes now cover electronic records.
How Much Prison Time and How Big a Fine
At the federal level, basic unauthorized access to a protected computer with no aggravating factors is a misdemeanor carrying up to one year in prison. The maximum jumps to five years if any of these apply:
- The offense was committed for commercial advantage or private financial gain.
- The unauthorized access was used to further another criminal or wrongful act.
- The value of the information obtained exceeded $5,000.
- The person accessed the computer with intent to defraud and obtained something of value.
Changing a grade to keep a scholarship worth tens of thousands of dollars typically lands in the five-year felony tier. A second CFAA conviction doubles the ceiling to ten years. The 20-year maximum that appears in the statute applies only to offenses involving classified national defense information and does not reach grade-tampering.1Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
State penalties vary. Misdemeanor outcomes include fines of a few thousand dollars, probation, community service, or up to a year in jail. States elevate the offense to a felony when there are aggravating factors like altering records for multiple students, causing significant damage to the school’s systems, or taking payment for changing grades. Felony penalties in many states reach five to ten years in prison and fines of $10,000 or more.
Restitution to the School
Federal courts are required to order restitution for certain offenses, meaning the offender has to reimburse the school for its actual financial losses.3Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes Those losses can include the cost of hiring cybersecurity firms to investigate the breach, repairing compromised systems, staff time spent auditing records, and repayment of any scholarships or aid obtained through the fraudulent grades.
In one federal case, a former college student who pleaded guilty to hacking his school’s grading system was ordered to pay more than $72,000 in restitution, which included repaying a $30,000 scholarship. He faced a maximum of five years in federal prison and a $250,000 fine. State courts impose similar restitution orders under their own statutes.
Restitution debt is sticky. It often survives bankruptcy and can be collected through wage garnishment years later.
School Discipline Is a Separate Process
The school’s disciplinary process runs on its own track, independent of any criminal case, and usually moves faster. A student caught tampering with grades faces consequences under the institution’s code of conduct whether or not prosecutors ever file charges.
For current students, the common outcomes are immediate suspension or permanent expulsion. The altered grade gets reverted, and the course is almost always failed. The incident becomes part of the student’s disciplinary record, which other schools can see in the admissions process, which makes transferring extremely difficult.
Graduation does not put you beyond the school’s reach. Both public and private colleges have the legal authority to revoke degrees that were awarded based on fraudulent records, and courts have consistently upheld that power. The school may also notify other institutions or employers that received the fraudulent transcript, which can mean rescinded graduate school admissions or job termination.
FERPA Does Not Keep This Private
Students sometimes assume federal privacy law shields their school records from police. That assumption is only partially right. Under FERPA, education records generally require consent before disclosure, but records created and maintained by a school’s designated law enforcement unit for a law enforcement purpose are exempt from FERPA entirely. If campus police or security investigates the tampering and keeps its own files, those files can be shared with outside law enforcement without the student’s consent.4eCFR. 34 CFR 99.8 – What Provisions Apply to Records of a Law Enforcement Unit
Long-Term Consequences After the Sentence
A computer fraud conviction creates a criminal record that surfaces on background checks for years. Most employers run them, and a fraud-related felony is one of the hardest categories to explain away. Industries dealing with sensitive data, financial systems, or government contracts are especially unforgiving.
Professional licensing boards in fields like law, medicine, accounting, teaching, and finance review criminal histories before issuing credentials. Convictions involving fraud, dishonesty, or deception routinely trigger denial or revocation of professional licenses. Someone convicted of hacking a grading system at 19 may find a decade later that they cannot sit for the bar exam or get a teaching credential. Security clearances for government or defense work are also very hard to obtain with a computer fraud conviction on record.
For non-citizens, a fraud conviction can trigger deportation proceedings or bar future immigration benefits. Some states allow offenders to petition for expungement after completing their sentence, but eligibility rules and waiting periods vary widely, and a felony fraud or computer crime conviction is among the harder categories to seal.
What Pushes a Case Toward the Harsher End
Not every grade-tampering case ends in a felony conviction and years in prison. A few factors shape where a case lands.
Age of the Offender
A minor caught changing grades is typically processed through the juvenile justice system, which was designed around rehabilitation rather than punishment.5Office of Juvenile Justice and Delinquency Prevention. Age Boundaries of the Juvenile Justice System Juvenile proceedings are usually sealed, and the focus leans toward counseling, community service, and supervised probation rather than incarceration.
Scope and Motive
A student who changed a single personal grade is in a different situation than someone who altered records for multiple students in exchange for payment. The latter shows an organized criminal scheme and draws felony charges much more readily. Lowering another student’s grades is treated as a malicious act that increases severity.
Damage to the System
If the intrusion caused damage beyond the altered grade, such as corrupting other database records, exposing student personal information, or forcing the school to rebuild its systems, penalties escalate. The CFAA specifically accounts for damage and loss when determining which penalty tier applies, and the cost of responding to the breach feeds into restitution.
Cooperation During the Investigation
Behavior after getting caught matters. Cooperating with investigators, accepting responsibility, and showing genuine remorse can influence both prosecutorial charging decisions and sentencing. Deleting logs, destroying evidence, or lying to investigators does the opposite, and obstruction can become its own additional charge.