Online exam cheating

What online proctoring can and cannot detect

This guide is written for exam offices and faculty. It explains what proctoring detects so institutions can choose the right setup, and it contains no instructions for avoiding detection.

Every season, faculty, parents and candidates bring the same questions to the exam office. Can proctored exams detect phones? Can a proctor see your screen? What about a second monitor, an earpiece or a virtual machine? This guide answers each one plainly, including the cases where the answer is "not on its own". It is part of our wider guide to how students cheat in online exams.

The same principle applies to every answer: a detection is a signal for a person to review, and it never settles the outcome by itself. On Proctorly, a trained reviewer looks at every flag, and your institution makes the final decision.

The short answer on phones

Yes, within limits. Proctorly flags phones and other devices that appear in the camera’s view. That covers the most common pattern behind searches like “how to cheat with phone in exam”: a phone on the desk, in the hand or raised into frame.

The limit is physical, because a webcam only sees what is in front of it, and a phone kept entirely outside the frame is invisible to it. So phone-based cheating is handled in layers. The camera catches what it can, behavior signals pick up a candidate who keeps looking down, exam design makes a quick search less useful, and at higher assurance levels live proctors can step in.

A quick reference: what is detected, and the honest limit

Threat What Proctorly does Honest limit
Phones and other devices Flags devices in the camera’s view Can’t see a device fully outside the frame
Second monitors Detects extra monitors, and the Windows desktop agent checks for extra or mirrored displays Agent checks apply only where the agent is installed
Screen activity Locked browser session, tab and window events, and screen capture where the exam requires it Captures only what the institution’s rules allow
Earpieces The Windows desktop agent checks for Bluetooth earphones A wired or unconnected device is left to the camera
Virtual machines Virtual-machine detection, plus agent checks on Windows Each detection is reviewed in context
Remote access Detects remote-assistance tools, and the agent checks for remote-access tools and VPNs Managed computers may run support tools legitimately
AI tools Detects known generative-AI tools from a maintained list, plus overlays and AI browsers Can’t see AI on a device outside the frame
Impersonation Continuous face verification with replay rejection, photo ID and active liveness Virtual-camera detection is planned. A failed check goes to a person, never to an automatic fail
Room checks A live check-in with a proctor at the Live dedicated level A check covers one moment of the sitting

Threat by threat

Phones and second devices

Exam offices ask about second device detection in online exams more than any other check. On Proctorly, phones and other devices that come into the camera’s view are flagged with a clip or snapshot, and repeated glances downward can also raise a behavior signal for review.

The reviewer then decides what the clip shows. A phone picked up and used during a no-phones sitting is usually clear. A phone that buzzes on a shelf and is ignored is not misconduct. Both are recorded with the reason. Candidates may also be asked to photograph handwritten working on a phone for upload, which is a permitted use, and your exam rules should say so.

Second monitors

Second monitor cheating means reading answers from another screen while the exam stays open. So can proctored exams detect a second monitor? Proctorly detects extra monitors, and the exam runs in a locked browser session that records tab and window events. Where an exam needs it, the Windows desktop agent also checks for extra or mirrored displays.

Can a proctor see your screen?

That depends on the rules your institution sets for the exam. On Proctorly, a candidate’s face, audio and screen may be recorded, and candidates are told what is captured before they start, so nothing is monitored in secret. When the screen is captured, the reviewer sees it on the same timeline as the webcam and the event log and can tell what was on screen at a flagged moment.

Where the desktop agent is used, it notes that an app is open and never reads the candidate’s documents.

Earpieces and Bluetooth devices

Earpiece cheating means someone feeds answers to the candidate through a small earphone. On Windows, the desktop agent checks for Bluetooth earphones connected to the computer. An earpiece that isn’t connected to the exam computer is left to the camera and microphone, so the reviewer looks for visible devices and for behavior that matches someone listening and responding. The live proctoring levels add a person watching in real time.

Room scans

A room scan is a short check, usually at the start of a remote exam, where the candidate turns the camera to show the room and desk. Room scan proctoring helps confirm that no notes, devices or other people are in the space at that moment. On Proctorly, the Live dedicated level includes a live check-in with a proctor.

Because a room scan only covers one moment, it works best alongside continuous monitoring and review.

Virtual machines

Searches for virtual machine cheating exam refer to running the exam inside a virtual machine so other software stays hidden from it. Proctorly detects virtual machines, and the desktop agent checks for them on Windows. The reviewer records when the detection happened and what else was running, since a detection at the start of a session is handled differently from one found midway.

Remote desktop and remote access

Remote desktop cheating means another person watches or controls the candidate’s computer from somewhere else. Proctorly includes remote access detection for online exams. It detects remote-assistance tools, and on Windows the desktop agent checks for remote-access and recording tools and VPNs. Some institution-managed computers run legitimate support software, which is one reason a person reviews every detection before anything is decided.

AI tools on the same computer

Proctorly detects known generative-AI tools from a maintained list, along with known overlay apps and AI browsers. We state the limit plainly: a camera and a screen recording can’t see every way of getting help. Our guide to AI cheating in exams covers the policy and design side.

What proctoring cannot see

Can online exams detect cheating? They can detect many kinds, though never all of them. A webcam doesn’t see outside its frame, and a screen capture doesn’t see a second device. A desktop agent can’t check a computer it isn’t installed on, and a helper who never speaks or appears on camera may leave no trace at all.

Proctorly is designed to put those limits on the record. Five evidence labels are planned (Observed, Suspected, Blocked, Unobservable and Unavailable), so a technical failure stays in its own category and out of the integrity score. We also publish the principles of what each setup can and cannot observe, and a full coverage summary is planned. See what we can and cannot see for what the Trust center shows today.

This matters at appeal. “The exam was monitored” is weak evidence. A panel can rely on a record that says which threats were monitored, what was outside the setup’s view and what the reviewer saw.

How to detect cheating in online exams fairly

Detection works best as one part of a wider system:

  1. Choose an assurance level per exam. Recorded, Every flag reviewed, Live pop-in or Live dedicated. See online proctoring.
  2. Use the desktop agent where the stakes justify it. It runs on Windows and adds checks no browser can make.
  3. Design papers that resist quick lookups. Use item pools, randomized order, section timers and questions that need working. See lockdown browser cheating for why the browser alone isn’t enough.
  4. Send every flag to a person. On Proctorly, no automated flag fails a candidate. A trained reviewer records a decision with a reason, and your committee decides. See human review proctoring.
  5. Tell candidates what is captured. Clear rules deter attempts and reduce disputes.

Frequently asked questions

Can proctored exams detect phones?

On Proctorly, proctored exams flag phones and other devices that appear in the camera’s view, and repeated looks downward can raise a behavior signal. A camera can’t see a device kept fully outside its frame, so phone use is also handled through exam design, live proctoring at higher levels and a trained reviewer who looks at every flag before the institution decides.
Can proctored exams detect a second monitor?

Yes. Proctorly detects extra monitors and records tab and window events inside a locked browser session. For exams that need deeper checks, the Windows desktop agent also looks for extra or mirrored displays. Each detection is a signal for a reviewer, who records what it means before the case reaches your institution.
Can a proctored exam see your screen?

It can if the institution’s rules for that exam include screen capture. On Proctorly, candidates are told before the exam what is captured, which may include face, audio and screen, and monitoring is never hidden. Where the desktop agent is used, it notes which apps are open but never reads the candidate’s documents.
Can proctoring detect an earpiece?

On Windows, the Proctorly desktop agent checks for Bluetooth earphones connected to the computer. For an earpiece that isn’t connected, detection depends on what the camera and microphone pick up, such as a visible device or behavior that matches listening and answering. Live proctoring adds a person watching in real time, and a reviewer looks at every flag in context.
What does an Unobservable label mean?

It will mark something the setup couldn’t see, so the record is honest about its limits. Proctorly’s five evidence labels (Observed, Suspected, Blocked, Unobservable and Unavailable) are planned. They will keep technical failures and blind spots out of the integrity score, so a candidate is never penalized because a camera failed or a threat was outside the setup’s view.

Ask us what your setup would see

Share an exam and its stakes, and we will show you what each assurance level observes, what it does not, and how flags are reviewed.

  • 1Choose your country and a time inside our global business hours, shown in your local time.
  • 2Tell us who you are and what you would like to see.
  • 3Get your Microsoft Teams meeting link and calendar invitation at once.