People can be registered, or deregistered as organ donors without their knowledge, the BBC has learnt.
BBC West Health Correspondent
Since 2000, volunteers have been able to register as organ donors on the internet through the Bristol-based UK Transplant website.
But company director Douglas Leith, from Aberdeen, found he could change other people's records on the site.
UK Transplant said from April it will write to people by post to confirm any changes made online.
Mr Leith managed to change his wife's details
"My wife and I decided we'd try and alter each others records - and it was possible," said Mr Leith.
"As long as you know the name, address and date of birth you could alter the records of organ transplant wishes.
"Neither of us would have ever known because there was never any confirmation of the change.
"Anyone could go online and alter someone's donation wishes without their knowledge either maliciously or accidentally.
Mr Leith said he complained to UK Transplant over a year ago and it acknowledged this was possible.
But he said he was told there was no need for them to do anything about it because they were happy with the system.
UK Transplant said other checks were in place in the system
He is calling for the site to be made more secure by the use of usernames and passwords, and for written notification to be sent when any changes are made to a person's details.
David Shute, director of operations at UK Transplant said the service accepted there were problems with the website but thought the likelihood of details being changed was very small.
"We think the possibility of it happening is extremely remote - there are other checks in place in the system," he said.
"But we are now acknowledging people's applications in writing from April and also to thank them for registering.
"We feel we have addressed Mr Leith's concerns," he said.
The website has increased the number of people registering as potential organ donors. In 2005, 50,000 of the one million people who registered did so online.