Online Exam Cheating Methods and Mitigation Strategies

Discover how candidates cheat in online exams and learn which proctoring, monitoring, and security measures are most effective for stopping each method.

Candidates may attempt to cheat using mobile phones, external devices, AI tools, screen sharing, hidden notes, virtual machines, online searches, or by receiving help from someone nearby. Cheating can be reduced by continuous screen and webcam proctoring, identity verification, and lockdown browser to make unauthorized activity easier to detect and limit opportunities for external help.

Research from 2023 examining university students reported that 60% of students admitted to cheating during online exams most of the time, and an additional 30% admitted to cheating at least once [1].
The flexibility and privacy of remote exams make cheating more tempting, as the lack of supervision allows candidates to seek ways to bypass restrictions. A systematic review on the prevalence of cheating in online exams noted that students most often cheated simply because the opportunity existed [2].

1. Impersonation (Another person taking the exam)

The candidate shares their username/password with another person. The other person logs in and completes the exam on their behalf. This is often done by a friend or a paid “exam taker,” also known as a proxy test taker.

How photo ID verification stops impersonation

ID verification requires the candidate to prove their identity using both an official document and their live facial appearance.

During the verification process, the candidate must provide:

  • A government-issued ID (passport, national ID card, driver’s license)
    • A live photo of their face captured through the webcam

      The system then uses AI-based facial matching to compare the face on the ID with the live face in front of the camera. If the live face does not match the ID photo, the system immediately flags the attempt or blocks entry to the exam.

      How proctoring prevents impersonation

      Proctoring continuously monitors the candidate’s identity, behavior, surroundings, and computer activity throughout the entire exam. It makes it extremely difficult for someone other than the registered candidate to take the test or assist them from off-camera.

      Proctors watch the candidate in real time through the webcam.

      This prevents impersonation because:

      • The person on camera must remain the same throughout the exam.
        • If someone tries to switch seats after ID verification, the proctor sees it immediately.
          • Any unusual body movement, shadow, or second person entering the frame is instantly flagged.
            • Human presence alone makes candidate swapping almost impossible.

              2. Using phones or secondary devices

              Candidates place a phone on their lap, just below the webcam’s view, and repeatedly look down to search answers on Google, ChatGPT, or notes. They quietly use WhatsApp, Telegram, or similar apps to message someone who sends answers back in real time, usually with the phone held low or under the desk. They quickly take pictures of questions with a phone and send them to a friend or tutor who replies with the correct answers.

              They place the phone directly behind the laptop screen or slightly to the side, then lean back or tilt their head slightly to read answers without the camera noticing. A second device, such as another laptop or a tablet, is placed outside the webcam frame, usually to the right or left of the main screen, and is used to look up answers or run AI tools.

              How proctoring prevents cheating with phones and secondary devices

              Modern platforms combine AI proctoring, live human proctoring, multi-camera monitoring, and screen proctoring to eliminate blind spots and detect suspicious behavior instantly.

              Proctoring works by continuously monitoring the candidate’s:

              • Face and eye direction
                • Head and body posture
                  • Hand movements and arm position
                    • Surrounding environment

                      AI-proctoring analyzes the video feed to detect patterns commonly associated with device usage, such as:

                      • Repeated downward glances toward the lap
                        • Looking off-screen to the left or right
                          • Subtle hand movements under the desk
                            • Posture shifts toward hidden devices
                              • The glow of a phone screen
                                • Whispering or lip movement (voice-to-AI use)

                                  Live human proctors reinforce this by visually identifying behaviors AI may flag, including:

                                  • Reaching for an object outside the frame
                                    • Interacting with something below the desk
                                      • Checking a device behind the laptop
                                        • Communicating with someone off-camera

                                          They can issue warnings, ask for a repositioning of the camera, request a room scan, or stop the exam if device usage is confirmed.

                                          Multicamera proctoring

                                          Multi-camera proctoring removes typical cheating blind spots. The laptop webcam shows the candidate’s face and upper body, while a second camera (often the candidate’s phone) captures their hands, lap, desk surface, and the sides of the laptop. This prevents common device-based cheating methods such as:

                                          • Hiding a phone on the lap
                                            • Placing a device behind or beside the laptop
                                              • Using a tablet just out of the webcam frame
                                                • Placing a phone on the floor angled upward

                                                  3. Searching answers online (Tabs, incognito, other browsers)

                                                  Candidates keep the exam open in one tab, then open a new tab to search answers on Google, ChatGPT, YouTube, or question-bank websites. They switch back and forth quickly, hoping the proctor or system won’t detect the tab changes.

                                                  Instead of using regular tabs, some candidates open incognito or private windows. They believe private windows are less detectable and leave no browsing history, making it harder for a simple monitoring setup to catch them. They keep the exam visible on one window while searching in an incognito window next to it or behind it.

                                                  How a browser lockdown prevents candidates from searching for answers online

                                                  A browser lockdown completely restricts what a candidate can do on their computer during the exam. It forces the exam to run in a controlled, isolated, full-screen environment, and prevents the candidate from accessing any external websites, applications, or tools.

                                                  When the lockdown browser is active, the system automatically disables or blocks:

                                                  • Opening new tabs or windows: Candidates cannot open additional tabs in the same browser, and they cannot open separate browser windows behind or beside the exam.
                                                    • Switching to incognito/private mode: Incognito windows are blocked at system level, preventing candidates from privately searching for answers without leaving a trace.
                                                      • Launching a different browser: If the candidate tries to open another browser while the exam is active, the lockdown browser stops the action immediately.

                                                        How screen monitoring prevents candidates from searching for answers online

                                                        Real-time screen proctoring gives the proctor or AI a live view of the candidate’s entire computer screen, making every attempt to access Google, ChatGPT, or any other online resource immediately visible.

                                                        Because the screen is continuously monitored, candidates cannot secretly open new tabs, switch browsers, or hide search windows behind the exam. Every on-screen action is captured the moment it happens.

                                                        If a candidate tries to:

                                                        • Open a Google search,
                                                          • Type a question into ChatGPT,
                                                            • Open Wikipedia or answer websites,
                                                              • Launch an incognito/private window,

                                                                The proctor or AI system instantly sees the new tab or window pop up on the screen. No browsing activity can be hidden.

                                                                4. AI-based cheating (ChatGPT & OCR Tools)

                                                                Candidates often misuse AI by taking the question they see on the exam screen and sending it to an AI chatbot for an instant solution. After reading the exam question, they either manually type it or copy–paste the text into an AI tool. This can happen in several ways:

                                                                • They may switch to another tab in the same browser and open ChatGPT, Gemini, Claude, or another AI assistant.
                                                                  • Some use a different browser entirely (e.g., exam in Chrome, AI in Firefox) to avoid detection.
                                                                    • Others move to a secondary device such as a phone or tablet where the AI tool is open and ready.

                                                                      Once the question is entered into the AI chatbot, the model immediately generates the solution, often faster and more accurately than manual searching. The candidate then returns to the exam window and uses the AI-generated response.

                                                                      How proctoring prevents AI-based cheating

                                                                      By combining AI monitoring and human oversight, proctoring exposes every attempt to access or use AI, whether on the exam device or an external device like a phone.

                                                                      Proctoring blocks AI cheating in two major ways:

                                                                      • Detecting on-screen AI use,
                                                                        • Detecting off-screen AI use,

                                                                          On-screen AI use

                                                                          AI and human proctors continuously watch the candidate’s screen and webcam feed. This exposes any attempt to use AI directly on the exam device, including:

                                                                          • Opening ChatGPT, Gemini, or Claude in a new tab
                                                                            • Switching browsers to access AI
                                                                              • Using AI-enabled browser extensions,
                                                                                • Running local AI apps or code helpers
                                                                                  • Opening split-screen or background windows with AI
                                                                                    • Pasting copied text into an AI tool

                                                                                      Even brief flashes of an AI window are visible to the proctor.

                                                                                      Off-screen AI use

                                                                                      Proctoring continuously monitors the candidate’s face, upper body, eye movement, and behavior, making it difficult for them to use AI tools on external devices without revealing visible cues.

                                                                                      Proctors can detect suspicious physical behavior linked to AI use, such as:

                                                                                      • Repeated downward glances toward a phone hidden on the lap,
                                                                                        • Constant eye shifts to the side where a tablet or second laptop may be placed,
                                                                                          • Head movements that indicate the candidate is reading from another device,
                                                                                            • Shoulder or upper-body leaning toward something off-screen,
                                                                                              • Hand movements suggesting interaction with an object below or beside the desk,
                                                                                                • Patterns of looking away from the monitor right before typing an answer.

                                                                                                  Candidates attempting to use a phone on their lap, a tablet or device placed beside the exam laptop, AI responses displayed just outside the camera’s view, inevitably reveal non-natural viewing angles, repeated glances, or physical motion that is inconsistent with focused exam behavior.

                                                                                                  These behavioral cues become obvious indicators of external AI use, allowing human or AI proctors to flag, warn, or terminate the session even with just a single camera.

                                                                                                  5. Screen sharing with others

                                                                                                  Some candidates launch or join a hidden video call where they secretly share their screen with a friend, tutor, or hired helper. The helper watches the exam questions appear, researches or solves them, and feeds back the answers through text or voice. Candidates often place the call window behind the exam window or on another desktop.

                                                                                                  Candidates sometimes install remote-access software before the exam.

                                                                                                  When the exam starts, the helper can see the exam questions in real time and guide the candidate by giving answers. The candidate remains on camera to look like they’re taking the test themselves while someone else essentially “co-pilots” from afar.

                                                                                                  Instead of using apps, some candidates mirror their laptop screen to a TV, another computer, a tablet, or a phone placed elsewhere in the room. This allows another person to sit off-camera and watch the entire exam.

                                                                                                  How a lockdown browser prevents screen sharing

                                                                                                  A lockdown browser it restricts the candidate’s device to a single, secure testing environment. When the lockdown browser is active, candidates cannot launch, access, or interact with any software or feature that could broadcast their screen to someone else.

                                                                                                  A lockdown browser blocks every major application that could be used to share the candidate’s screen with someone else. It prevents launching or running tools such as:

                                                                                                  • Zoom, Microsoft Teams, Google Meet, Skype, Discord
                                                                                                    • OBS and other streaming software
                                                                                                      • AnyDesk, TeamViewer
                                                                                                        • Chrome Remote Desktop
                                                                                                          • Co-browsing extensions

                                                                                                            Even if these applications are already open in the background, the lockdown browser automatically forces them to close when the exam starts, preventing anyone else from viewing, controlling, or accessing the candidate’s screen.

                                                                                                            6. Getting help from someone in the room

                                                                                                            A helper can simply stay in the same room, sit or stand wherever they want, and support the candidate throughout the exam. They may sit next to the desk, behind the candidate, near the door, or anywhere else in the room where they can comfortably see or hear the questions.

                                                                                                            The helper can read the questions directly from the candidate’s screen or wait for the candidate to read them out loud.

                                                                                                            From there, the helper provides the answers openly by speaking normally, discussing the question, explaining the reasoning, or giving instructions without restriction. If needed, they can also use books, notes, or online tools to look up the information and deliver the correct response.

                                                                                                            How proctoring prevents in-room assistance

                                                                                                            By monitoring the candidate’s environment, behavior, and audio in real time, proctoring makes it extremely difficult for another person to remain in the room without being detected.

                                                                                                            Proctoring continuously analyzes the candidate’s eye movement, body posture, and surrounding audio to detect signs of in-room assistance. Human and AI proctors look for patterns such as:

                                                                                                            • Eye and head cues: repeated side glances, fixed stares at a specific point off-screen, sudden eye shifts, or looking behind or beside the laptop.
                                                                                                              • Suspicious audio: whispering, faint speech, background conversation, footsteps, or any unexpected voice indicating someone else is present.
                                                                                                                • Upper-body behavior: turning toward someone, leaning repeatedly in one direction, reacting to off-camera signals, or looking down at notes or gestures.

                                                                                                                  These visual and audio indicators together make it easy for proctors to spot when a candidate is receiving help from someone in the room.

                                                                                                                  7. Using cheat sheets & Hidden notes

                                                                                                                  Candidates often rely on physical or digital notes placed outside the monitored area to access information during an online exam.

                                                                                                                  • Notes outside the camera’s view: placed on the desk edge, floor, wall, or beside the laptop where they can be glanced at discreetly.
                                                                                                                    • Notes attached to the laptop or monitor: hidden behind the screen, under the keyboard, or taped to the side of the device.

                                                                                                                      How proctoring prevents the use of cheat sheets and hidden notes

                                                                                                                      Proctoring makes it extremely difficult for candidates to use hidden notes by monitoring their environment, body language, and behavior throughout the exam.

                                                                                                                      Effective prevention includes:

                                                                                                                      • Room and desk scans: Candidates must show their desk, the floor, and their surroundings before the exam begins, exposing any notes placed nearby.
                                                                                                                        • Monitoring eye and head movement: Repeated downward glances or looking to the sides signals that the candidate may be referencing hidden notes.
                                                                                                                          • Watching body posture and hand activity: Leaning down, lifting objects, or interacting with items off-camera are strong indicators of hidden materials.
                                                                                                                            • Two-camera proctoring: The second camera shows the candidate’s lap, desk surface, hands, and side areas, revealing notes placed below or beside the main screen.
                                                                                                                              • Detecting objects in the workspace: Proctors can spot papers, books, or unusual items that could contain information.

                                                                                                                                8. Technical manipulations

                                                                                                                                Candidates run the exam inside a virtual machine and use the real operating system to browse, search, or run unauthorized tools.

                                                                                                                                Common intentions include:

                                                                                                                                • Hiding browser windows behind the VM,
                                                                                                                                  • Bypassing lockdown browsers,
                                                                                                                                    • Isolating monitored vs. unmonitored environments.

                                                                                                                                      Candidates use macOS Mission Control or Windows Task View to create:

                                                                                                                                      • A second desktop with forbidden apps,
                                                                                                                                        • An unmonitored workspace for searching answers,
                                                                                                                                          • Quick switching between desktops with shortcuts.
                                                                                                                                            • This attempts to hide activity that proctors can’t see.

                                                                                                                                              How screen proctoring prevents technical manipulations

                                                                                                                                              Screen proctoring prevents candidates from using virtual machines or multiple desktops by showing exactly what happens on their device in real time. Proctors and AI can immediately spot:

                                                                                                                                              • Switching between desktops or virtual workspaces,
                                                                                                                                                • Jumping out of full-screen mode
                                                                                                                                                  • Opening hidden windows behind the exam
                                                                                                                                                    • Dragging unauthorized apps into view
                                                                                                                                                      • VM interfaces, hypervisor prompts, or virtualization toolbars

                                                                                                                                                        Because every on-screen action is visible, any attempt to access an unmonitored environment becomes clear and is flagged instantly. This makes it extremely difficult for candidates to hide secondary desktops, run VMs, or operate unauthorized tools during the exam.

                                                                                                                                                        9. Collaboration with others (Online chat, group help)

                                                                                                                                                        Candidates often use chat applications on another device to send questions and receive immediate answers. Some candidates join group chats where multiple people help simultaneously. These groups discuss questions, cross-check answers, solve problems collectively, share reasoning or explanations. The candidate follows the group’s suggestions and enters the answer in the exam.

                                                                                                                                                        How LOFT testing prevents collaboration

                                                                                                                                                        Linear-on-the-fly testing prevents candidates from collaborating with others by giving every test-taker a unique, personalized version of the exam. Because no two candidates receive the same set of questions in the same order, coordinating answers with friends, study groups, or online helpers becomes extremely difficult.

                                                                                                                                                        LOFT reduces collaboration by:

                                                                                                                                                        • Generating a different question set for each candidate from a large item bank, so helpers cannot rely on seeing the same questions.
                                                                                                                                                          • Randomizing question order and content, preventing candidates from saying “I’m on question 5” or matching answers with someone else.
                                                                                                                                                            • Randomizing answer options, making it impossible to share answer keys (e.g., “the answer is C”).
                                                                                                                                                              • Delivering items based on predefined rules, so each candidate follows a unique but controlled test blueprint.
                                                                                                                                                                • Minimizing question overlap between candidates taking the exam at the same time, reducing the value of group chats or shared answer sheets.
                                                                                                                                                                  • Protecting high-stakes items by distributing them differently across individuals, making it harder for groups to leak and solve questions together.

                                                                                                                                                                    With LOFT, even if candidates try to collaborate via chat groups, messaging apps, or shared notes, their exams will not match, and the answers provided by others will often not apply. This breaks the efficiency of real-time group support and makes collaboration highly unreliable.

                                                                                                                                                                    How proctoring prevents collaboration

                                                                                                                                                                    Proctoring makes it extremely difficult for candidates to collaborate with others during an online exam by monitoring their behavior, audio, surroundings, and interaction patterns. Even if a candidate tries to communicate through a phone, another device, or directly from their computer, proctoring detects the cues that reveal external help.

                                                                                                                                                                    Proctoring detects collaboration through:

                                                                                                                                                                    • Eye and head movement: repeated side glances, looking down to read messages, or staring at a fixed point off-screen.
                                                                                                                                                                      • Hand and body movement: reaching for a phone, interacting with something off-camera, or leaning repeatedly toward another device.
                                                                                                                                                                        • Audio cues: whispering, faint replies, background conversation, or notification sounds that indicate active communication.
                                                                                                                                                                          • Screen activity: switching to chat apps, opening messaging platforms in other windows, or dragging hidden communication windows behind the exam.

                                                                                                                                                                            These combined visual, audio, and on-screen indicators make collaboration easy to identify, allowing proctors to flag or stop the exam immediately.

                                                                                                                                                                            Best Practices for Improving Test Security

                                                                                                                                                                            • Ensuring test security requires a structured approach that combines technical safeguards, monitoring solutions, and thoughtful assessment design.
                                                                                                                                                                              • Randomize questions and answer choices to minimize pattern-based cheating.
                                                                                                                                                                                • Use large question banks to ensure each candidate receives a unique set of items.
                                                                                                                                                                                  • Implement LOFT (Linear-On-The-Fly Testing) to generate dynamic, individualized exams.
                                                                                                                                                                                    • Enable screen, webcam, and audio proctoring to detect suspicious behaviors in real time.
                                                                                                                                                                                      • Use a lockdown browser to block new tabs, external apps, shortcuts, and unauthorized navigation.
                                                                                                                                                                                        • Set strict time limits for sections and questions to reduce the opportunity for external help.
                                                                                                                                                                                          • Require identity verification through ID check, face match, or two-factor authentication.
                                                                                                                                                                                            • Use AI-powered cheating detection for anomalies such as gaze shifts, multiple voices, hidden windows, or collaboration attempts.

                                                                                                                                                                                              Resources

                                                                                                                                                                                              [1] Malik, Aamir Abbas et al. “Impact of academic cheating and perceived online learning effectiveness on academic performance during the COVID-19 pandemic among Pakistani students.” Frontiers in psychology vol. 14 1124095. 2 Mar. 2023, doi:10.3389/fpsyg.2023.1124095

                                                                                                                                                                                              [2] Newton, P.M., Essex, K. How Common is Cheating in Online Exams and did it Increase During the COVID-19 Pandemic? A Systematic Review. J Acad Ethics 22, 323–343 (2024). https://doi.org/10.1007/s10805-023-09485-5

                                                                                                                                                                                              Frequently asked questions (FAQ)

                                                                                                                                                                                              Yes, modern online exams can detect cheating using a combination of webcam monitoring, screen proctoring, audio detection, browser lockdown, and AI-based behavior analysis. These systems can identify actions like tab switching, screen sharing, use of virtual machines, unusual movements, background voices, hidden devices, and attempts to collaborate with others. When combined, these tools make it possible to detect and often prevent most cheating attempts during an online exam.

                                                                                                                                                                                              Yes, online exam systems can detect when a candidate opens another tab, switches browsers, or navigates away from the test window. Screen proctoring and browser lockdown tools monitor tab changes and flag any attempt to access external websites or resources. Some platforms also generate automatic warnings or restrict the exam if repeated tab switching occurs.

                                                                                                                                                                                              Yes, it is possible, but it is extremely difficult. Modern online proctoring systems use multiple security layers, including webcam monitoring, screen proctoring, audio detection, browser lockdown, AI-driven behavior analysis, and even multi-camera setups. These measures make most cheating attempts easy to detect, from using external devices to collaborating with others or switching screens.

                                                                                                                                                                                              While no system can guarantee 100% prevention, a well-designed online proctored exam significantly reduces the chances of cheating and ensures a high level of exam integrity.

                                                                                                                                                                                              Yes, it is possible, but most attempts are blocked or detected. A lockdown browser is designed to block the most common cheating methods by preventing new tabs, applications, keyboard shortcuts, screen sharing, and external navigation.

                                                                                                                                                                                              However, a lockdown browser alone cannot prevent every type of cheating. Without additional measures like proctoring, candidates could still attempt methods that happen outside the device, such as using hidden notes, external devices, or getting help from someone off-screen.

                                                                                                                                                                                              Yes, it is possible, but the opportunities are extremely limited. Two-camera proctoring gives a full view of both the test-taker and their surroundings, making it much harder to use hidden notes, external devices, or get help from someone off-screen. The front webcam monitors facial movements and on-screen behavior, while the secondary phone camera captures the desk, hands, and room environment.

                                                                                                                                                                                              With both angles monitored (often combined with audio detection and AI analysis), most cheating attempts become immediately visible. While no system can guarantee 100% prevention, two-camera monitoring significantly reduces the chances of cheating and provides a much higher level of exam security.

                                                                                                                                                                                              Created on 2025/11/27 Updated on 2025/11/27 Share
                                                                                                                                                                                              Go Back

                                                                                                                                                                                              Talk to a representative

                                                                                                                                                                                              Discover how TestInvite can support your organization’s assessment goals