Background: Instances of academic dishonesty are common in online learning environments because difficulties in their detection result in considerably low degrees of risks. However, if not identified, the noise introduced by dishonest learners in MOOCs' clickstream data could lead to biased results and conclusions in scientific research. Objectives: This study aimed to identify and quantify the most frequent undesirable behaviour employed by students to earn completion certificates. Methods: We employed descriptive and inferential statistics to analyse a Brazilian Moodle-based MOOC platform's clickstream data. The database had information related to 113 MOOCs, and 297,687 students who obtained 109,050 certificates from 2016 to 2023. The MOOCs were organised in two groups, with and without a minimum time-on-course restriction. Results and Conclusions: Amongst the issued certificates of MOOCs without the minimum time-on-course restriction, around 51% were obtained via Fast certificate issuance, while for MOOCs with the restriction, only 2% of certificates were obtained this way. We conclude that this difference in course configuration is key in explaining the identified behaviours. Implications: The results indicate that the number of instances of undesirable behaviours in MOOCs might be much higher than reported, posing a potential threat to this educational model. Also, the nature of this behaviour is dependent on course configurations.