Why online exam cheating looks different now
Ten years ago, cheating in an online exam mostly meant notes beside the keyboard or a friend in the room. That still happens. The methods candidates search for today, though, have moved off the webcam. Generative AI assistants, screen overlays floating above the exam, phones held out of view, remote-control apps and virtual machines all aim at the gaps a camera-only check leaves open.
That changes what your institution needs. A webcam recording on its own shows the candidate’s face. It can’t show what is running on the computer, what device is under the desk or who is moving the mouse. Detection now has to cover identity, the browser, the computer and the room, and it has to feed into a review process people trust.
It also changes how to frame the problem. Every check has gaps, so asking whether one of them is perfect gets you nowhere. Ask instead whether your layers, taken together, make cheating hard, make it visible when it happens and give your committee a fair record to decide on.
The main cheating methods in online exams
Exam offices most often see nine families of cheating methods, listed below. We describe each one only at the level of what it is. The detection notes cover what online proctoring on Proctorly watches for.
Help from another person in the room
What it is: someone off camera reads out questions, suggests answers or passes notes.
How it shows up: the camera seldom sees the helper. It does pick up audio signals, such as a second voice, and behavior signals, such as the candidate looking to one side again and again. Proctorly raises unusual audio and movement as signals for a person to review in context, and never as findings.
How review handles it: the reviewer watches the flagged moment and looks for an innocent explanation. Household noise, a candidate reading aloud and disability-related movement are not misconduct. A second voice answering exam questions is another matter, and the reviewer records which it was and why.
Phones, earpieces and other second devices
What it is: a second device for looking up answers, messaging someone or listening to someone. Phones are the most common. Earpieces and smart glasses turn up less often, though people search for them a lot.
How it shows up: Proctorly flags phones and other devices in the camera’s view. For exams that need deeper checks, the Windows desktop agent also looks for Bluetooth earphones and USB devices connected to the computer.
How review handles it: a phone on the desk in a sitting where phones are banned is usually obvious on video, while a quick glance down is far less clear. The reviewer decides what the clip shows, and the record keeps the clip alongside the decision. Our guide on can proctored exams detect phones has a fuller list of what is and isn’t visible.
AI assistants, overlays and AI browsers
What it is: a generative AI chatbot used to answer questions during the exam. It might sit in another window, run as a screen overlay on top of the exam, live inside a browser built around an AI agent or run on a separate device.
How it shows up: Proctorly detects known generative-AI tools from a maintained list, along with known overlay apps and AI browsers. On Windows, the desktop agent adds checks on running apps and overlays.
The honest limit: a camera and a screen recording can’t see every way of getting help. An AI tool on a phone held out of view counts as a second-device problem, and software checks won’t catch it. So exam design matters as much as monitoring. Our guide to AI cheating in exams covers policy, design and detection together.
Leaving the exam: other tabs, windows and monitors
What it is: opening another tab, another application or a second monitor to look up answers with the exam still open.
How it shows up: the exam opens in a locked browser session. Tab and window events are recorded, and extra monitors are detected. On Windows, the desktop agent also checks for extra or mirrored displays, extra browser windows, tabs and extensions, and open office apps. It records that an app is open and never reads the candidate’s documents.
How review handles it: one window event could be a notification or a crash. Repeated switching during the hard questions suggests something else. The reviewer sees the events on the same timeline as the webcam and screen, with the context right there.
Remote access and screen sharing
What it is: someone elsewhere watches or controls the candidate’s computer through remote-assistance or screen-sharing software.
How it shows up: Proctorly detects remote-assistance tools. On Windows, the desktop agent checks for remote-access and recording tools and VPNs.
How review handles it: a remote-access tool running during a sitting is a strong signal, though still only a signal. Some candidates sit on institution-managed computers that have support software installed. The reviewer records what was found, and the institution decides with that context.
Virtual machines and altered computers
What it is: the exam runs inside a virtual machine (a computer running inside another computer), which keeps whatever runs outside it hidden from the exam. A related method uses browser extensions that change how the exam page behaves.
How it shows up: virtual-machine and browser-extension detection. The desktop agent checks for virtual machines on Windows too.
How review handles it: the reviewer confirms what was detected and when. A detection at the start of the session, before any question was answered, is treated differently from one found halfway through.
Impersonation and proxy test takers
What it is: someone other than the registered candidate sits all or part of the exam. In India this person is often called a proxy or dummy candidate.
How it shows up: the candidate’s face is matched at the start and continuously through the exam, and photo or video replays are rejected. Photo ID capture is set per exam, and active liveness adds a short challenge for high-stakes sittings. Detection of virtual cameras (software that pretends to be a webcam) is planned. You can read more in identity verification for online exams.
How review handles it: a failed face match goes to a person and never becomes an automatic fail. Lighting, a new haircut or a poor camera can all cause a mismatch. The reviewer compares the evidence and records the outcome.
Shared answers and leaked papers
What it is: questions or answers pass between candidates, through group chats or a paper leaked before the sitting.
How it is deterred: randomized delivery shuffles questions and options from item pools, so candidates sitting side by side get different papers. With the Proctorly Examination module, papers come from a sealed paper vault with timed release. For the wider problem, see our guide on exam paper leak prevention.
How review handles it: shared answers often surface after the exam, during marking. Your committee decides with the marks, the session records and the audit trail in front of it.
Collusion during the sitting
What it is: two or more candidates work together in real time, often from different places.
How it is deterred: item pools, section timers, locked navigation and adaptive testing make a shared paper far less useful. Candidates can also book their own slot within the times your proctoring capacity allows, which spreads sittings out.
How review handles it: collusion tends to be a pattern, rarely one moment, so it reaches the committee as a set of linked cases with evidence for each.
How detection works: layers, not one check
No one control covers every method above. What works is a set of layers, each catching what the others miss. This is how they fit together on Proctorly.
Identity through the whole session
Identity is checked at the start and all through the session, and each check is logged separately. If a candidate passes the face check at login and then gives up the seat to someone else, the later checks still see it.
A locked session and exam design
The cheapest cheating to deal with is cheating that never becomes possible. A locked browser session, randomized questions, item pools, section timers and question types that need working (numeric answers with tolerance, say, or handwritten working photographed on a phone and attached for the marker) remove many chances before anything needs flagging. All of these run on Proctorly’s online exam software.
Monitoring signals
While the sitting runs, Proctorly watches for a published set of known threats: AI tools, second devices, remote access, overlays, agentic browsers, virtual machines, extensions, extra monitors, screen recording, and audio and behavior signals. Each one produces a flag with a clip or snapshot.
The Windows desktop agent
For exams that need it, a small Windows app checks the computer itself for remote-access and recording tools, screen overlays, extra or mirrored displays, USB devices, Bluetooth earphones, virtual machines, VPNs, extra browser windows, tabs and extensions, and open office apps. Each check produces a signal for review, and none of them counts as proof.
Why a flag is not a finding
Detection is only half the job. The other half is deciding, fairly and on the record, what each flag means. On Proctorly, no automated flag fails a candidate or imposes a sanction. AI raises the flag, a trained reviewer looks at it and your institution makes the final decision. That is the core of human review proctoring.
What the reviewer sees
The reviewer console opens each case at the flagged moment, with webcam, screen and events on one timeline. A decision takes one key and needs a reason, and escalating takes one step. Each candidate also has a review priority score that shows the signals behind it. It is labeled as a priority for review and never as a finding.
At the Every flag reviewed level, a trained Proctorly reviewer looks at each automated flag before it gets to you. Reviewers work 24×7 during exams, in English, with one reviewer for every 40 candidates, and they review 95 of every 100 flags within 5 minutes. The remaining flags are still reviewed, only later.
Innocent explanations
Plenty of flags have ordinary causes. A candidate reads a question aloud, a sibling walks past or a notification pops up. Someone with a disability may move in a way an algorithm marks as unusual. Proctorly doesn’t score emotion, personality or “suspicion”, and reviewers are there to tell these cases apart from real incidents.
A technical failure is never treated as cheating. If a camera or upload fails, the interruption is recorded as a technical gap. A separate category that keeps such gaps outside the integrity score is planned.
From flag to committee decision
Confirmed incidents go into a malpractice workflow that ends in a recorded committee decision, and no penalty applies before that. Each case keeps the clips, the timeline, the reviewer’s reasoning and a tamper-evident audit trail, and it exports as one evidence pack for an appeal or an audit. If your institution handles exam malpractice under “unfair means” rules, the pack gives the committee what it needs to apply them.
What no proctoring setup can see
No proctoring product sees everything, and a vendor who says otherwise is overselling. A webcam sees what is in front of it, a screen recording sees the screen and a desktop agent sees the computer it runs on. None of them will spot a phone held below the camera line in a dark room, or a helper who never speaks.
We plan to publish a full summary of what each setup can and can’t observe, so your exam office can pick the right level for each exam and explain it to candidates and appeal panels. In the meantime, see what we can and cannot see for the principles the Trust center sets out today.
Being honest about limits is also practical. When a board asks whether an exam was secure, the most useful reply is specific: which threats were monitored, which were blocked, which fell outside what the setup could observe, and what the reviewers found.
Deterrence: why most candidates choose not to try
Detection catches attempts, and deterrence keeps them from starting. Most of that work comes down to three things.
Clear rules, told in advance. Candidates learn what is captured before the exam starts, and nothing is monitored in secret. If a candidate knows the camera, screen and computer are checked, and that a person reviews every flag, there is less reason to gamble.
Gentle reminders. On-screen nudges remind a candidate of the rules, such as staying in view, before anything is flagged. Each nudge is logged, and many problems stop there.
A visible, fair process. Candidates who know that flags go to a person, and that the institution decides with evidence, trust the process more and test it less. A strong academic integrity policy, explained before exam season, covers the rest.
A checklist for exam offices
Run through this before your next online sitting.
- Set an assurance level per exam. A weekly quiz needs different care from a licensing exam. Choose Recorded, Every flag reviewed, Live pop-in or Live dedicated.
- Decide on the desktop agent. For higher-stakes exams on Windows, the agent adds checks that a browser can’t make.
- Design the paper for online delivery. Use item pools, randomized order, section timers and question types that need working.
- Set identity rules. Choose whether each exam uses photo ID capture and active liveness.
- Publish the rules to candidates. Tell them what is captured, what is allowed and how to get help.
- Name your reviewers and decision makers. Agree who reviews cases, who sits on the committee and how candidates appeal.
- Brief faculty on innocent explanations. Everyone should understand that a flag is a signal and nothing more.
- Plan for technical failures. Agree ahead of time how you will handle a dropped connection or a failed camera.
For a broader plan, read our guide to exam security.
If you are a student reading this
If you landed here looking for ways to cheat, the honest answer is that the methods in this guide are exactly the ones proctoring is built to notice. Most leave a trace on the camera, the screen or the computer, and a person looks at every flag with the clip and the timeline in front of them.
Getting caught is only part of the cost. A confirmed incident goes to a committee, and an integrity record can follow you much further than a single exam score. If an exam is worrying you, talk to your faculty or exam office about support, extra time or accommodations, which keeps your result safe in a way cheating never will.
Explore this guide
Each of the guides below goes deeper into one part of the question.
- Cheating on proctored exams: webcam exams, what they watch and what happens after a flag.
- Can proctored exams detect phones: phones, second screens, earpieces, virtual machines and remote desktops, with honest limits.
- Lockdown browser cheating: why a locked browser alone falls short, and how bypass attempts are caught.
- AI cheating in exams: ChatGPT and other AI tools, and what institutions can do through policy, design and detection.
Frequently asked questions
What are the most common ways students cheat in online exams?
The most common are second devices such as phones, help from someone in the room, other tabs or monitors, and AI assistants. Remote-access tools, virtual machines and impersonation are less common but serious. Since each leaves a different trace and no one control covers them all, institutions use layers: identity checks, a locked session, monitoring signals and human review.
Can online exams detect cheating?
They can detect many methods, though not every one. Proctorly watches for a published set of known threats, including AI tools, second devices in view, remote access, virtual machines and extra monitors, and we state plainly what a camera or computer can’t observe. Detection raises flags, a trained reviewer looks at each one and your institution makes the final decision.
Does an AI flag mean a student cheated?
No. A flag says that something on the camera, screen or computer needs a look. Plenty of flags have innocent causes, such as reading aloud, household noise or a notification. On Proctorly, a trained reviewer looks at every flag and records a decision with a reason, and only your institution decides the outcome, with the full evidence in hand.
Is cheating software for online exams a real threat?
Yes. Software built to help candidates cheat, such as screen overlays, AI browsers and remote-access tools, is a real threat, so detection now has to look at the computer as well as the webcam. Proctorly detects known overlay apps, AI browsers, remote-access tools and virtual machines, and the Windows desktop agent adds checks on running apps. A person reviews each detection.
How should we explain proctoring to candidates?
Before the exam, tell them what is captured, why and for how long it is kept. Explain that AI raises flags, a person reviews each one and the institution decides. Share the rules, the help contact and the appeal process. Candidates who understand the process trust it more, and fewer of them try to test it.