Online exams make certain kinds of misconduct easier. Students may search for answers, communicate through another device, share questions, outsource written work, or use generative AI without permission. Institutions also need a reasonable way to confirm that the enrolled student completed the assessment.
The response, however, cannot simply be more surveillance.
How online assessment prevents cheating depends on a combination of assessment design, clear rules, proportionate identity checks, limited technical controls, and human judgment. The balance should change with the stakes. A weekly revision quiz does not need the same controls as a medical licensing examination.
The strongest approach starts with the assessment itself. Monitoring should address risks that remain after the task has been designed properly, not compensate for weak questions or vague academic-integrity policies.
Different Assessments Create Different Risks
“Online assessment” can mean a short multiple-choice quiz, a final examination, a programming project, an essay, a laboratory demonstration, or a professional certification test.
These tasks do not fail in the same way.
A recall-based exam is vulnerable to web searches and answer sharing. An essay can be outsourced or produced with undisclosed AI assistance. A coding task may contain copied material even when the student cannot explain how it works. A practical assessment may require observation because the final result does not show whether the candidate can perform the process safely.
Before selecting a proctoring platform or restricting a student’s device, an institution should answer three questions:
- What type of misconduct could undermine this assessment?
- How serious would an unreliable result be?
- What evidence would justify an academic-integrity investigation?
That last question is often neglected. A system may be good at creating alerts without producing evidence strong enough to support a fair decision.
No online assessment can be made entirely cheat-proof. The realistic aim is to reduce predictable opportunities, make serious misconduct harder, and preserve credible evidence when a concern arises.
How Online Assessment Prevents Cheating Most Effectively
Online assessment security usually relies on several layers. Each layer addresses a limited problem.
Institutional logins and identity checks can reduce impersonation. Question banks and randomised values make direct answer sharing less useful. Time windows can limit prolonged searching or coordination. Restricted browsers can block copying, printing, task switching, and visits to unapproved websites on the examination device.
Live or recorded proctoring may reveal another person in the room, unauthorised materials, repeated communication, or a student leaving the camera view. Similarity reports can identify passages that match indexed material. Oral follow-ups and process records can show whether a student understands submitted work.
None of these controls settles the entire question.
A login does not prove that the account holder completed every part of the work. A camera cannot see the whole room. A lockdown browser cannot control a second phone. A similarity score does not determine plagiarism. An automated proctoring flag cannot explain why a student looked away or lost video.
For most courses, the best defence is not the most restrictive tool. It is a well-designed assessment supported by a few controls chosen for a specific reason.
Better Assessment Design Removes the Easiest Shortcuts
Predictable questions are easy to search, share, or submit to an AI system. Adding a webcam may make the process more uncomfortable without making the task more meaningful.
More resilient assessments ask students to apply knowledge to unfamiliar material. A finance student might evaluate a new company case rather than reproduce a formula. A programming student might explain a design decision, revise faulty code, or defend part of a repository history. A teacher-training candidate might adapt a lesson plan for a particular class rather than submit a generic plan.
Other practical methods include:
- assigning different numerical values while testing the same calculation;
- drawing equivalent questions from a reviewed item bank;
- requiring a proposal, source list, draft, and final submission;
- collecting calculations, design notes, code commits, or laboratory records;
- asking a small sample of students to explain selected decisions orally;
- spreading assessment across several tasks instead of relying on one final submission.
These methods do not eliminate misconduct. They make it harder to submit work that the student cannot understand, reproduce, or defend.
They also produce better evidence. A polished final essay may have several possible origins. A sequence of notes, sources, revisions, and responses to feedback gives the assessor a clearer picture of how the work developed.
Open-book assessment can also be useful when the learning outcome involves analysis or judgment. It should not be treated as an easier version of a closed-book test. If every answer can be copied from lecture slides, the assessment remains weak.
Identity Checks Should Be Proportionate
Institutions can verify identity through an authenticated learning platform, multifactor authentication, a student card, a live visual check, or an approved testing centre.
The more intrusive options should be reserved for cases where identity risk genuinely matters.
A low-stakes quiz rarely justifies biometric identification. A professional examination linked to public safety, legal authorisation, or clinical competence may require stronger verification.
Institutions also need a process for failed checks. Poor lighting, damaged cameras, expired documents, name changes, image quality, and accessibility needs can all interfere with verification. These situations should be treated as problems to resolve, not immediate evidence of impersonation.
Facial-recognition technology deserves particular caution. NIST evaluations have shown that performance varies by algorithm, image quality, lighting, camera angle, and demographic group. That does not mean every identity system fails in the same way. It does mean that a facial match should never be treated as infallible.
A Lockdown Browser Secures One Screen, Not the Room
Restricted browsers can prevent students from opening other applications, copying text, printing questions, taking screen captures, or visiting unauthorised websites on the examination computer.
Respondus LockDown Browser is one widely used example, although the exact restrictions and device support vary by product and institutional configuration.
These tools can close obvious routes to misconduct on a single device. They cannot control a phone placed outside the camera view, paper notes, another laptop, or help from someone nearby.
That limitation is important. Staff may assume that a locked browser creates a controlled environment similar to an examination hall. It does not. It controls selected functions on one machine.
A practice test is essential before any high-stakes assessment that requires special software. Students need to check installation, operating-system permissions, webcam access, microphone access, assistive technology, and network behaviour.
The practice test should use the same technical setup as the real exam. A generic “system check” that does not launch the restricted browser or test required permissions may miss the problem that later interrupts the assessment.
Proctoring Flags Are Leads, Not Findings
Automated and recorded proctoring systems may collect webcam video, audio, screen activity, browser events, identity information, or movement-related signals.
Depending on the product, the system may flag events such as:
- another voice being detected;
- a face disappearing from view;
- unusual movement;
- an attempt to open a blocked function;
- the student leaving the camera frame;
- a connection or recording interruption.
These events do not explain themselves.
A student may look away while thinking, speak while reading a question, respond to a medical alert, adjust position because of pain, or lose camera access during a connection failure. Someone may enter a shared room despite the student’s efforts to prevent it.
The problem becomes serious when a platform’s output is treated as a judgment rather than a prompt for review.
A trained reviewer should examine the relevant recording or log, the assessment rules, approved accommodations, technical records, and the student’s explanation. Institutions should not allow an automated score to trigger an automatic zero, suspension, or misconduct finding.
A platform that produces more flags is not necessarily more accurate. It may simply be more sensitive to ordinary movement, poor video quality, or environmental noise.
Similarity Reports and AI Detectors Have Narrow Evidentiary Value
Text-similarity tools can identify matching passages. They cannot determine why the match exists.
A high similarity score may include references, quotations, standard terminology, assignment templates, or legitimate reuse. A low score does not rule out contract cheating, extensive paraphrasing, or work produced by another person.
Turnitin’s own guidance states that a Similarity Report identifies matching text rather than deciding whether plagiarism occurred. That distinction should appear in staff training and misconduct procedures, not only in vendor documentation.
AI-writing detection requires even greater restraint.
Current detectors make probabilistic classifications. They can miss AI-generated material, misclassify human writing, and become less reliable when text is edited, translated, or mixed with human work. Turnitin does not display precise AI-writing percentages below its stated threshold because the company reports a higher risk of false positives in that range.
Research has also raised fairness concerns about the treatment of writing by non-native English speakers. Detector technology will continue to change, but its central limitation remains: a score is not proof of authorship.
When concerns arise, stronger evidence may include:
- drafts and revision history;
- source notes;
- document metadata;
- comparison with earlier work;
- an oral explanation;
- the student’s ability to reproduce or defend key parts;
- evidence of undisclosed outside assistance.
An institution should never require a student to disprove an unexplained percentage generated by a commercial system.
Prevention, Deterrence, and Detection Are Not the Same
These terms are often mixed together in product claims.
Prevention blocks an action. A restricted browser may prevent a student from opening another application on the same computer.
Deterrence changes behaviour because the student knows monitoring or checking may occur.
Detection produces information about a possible violation, often after the event.
A camera may deter some behaviour. A similarity report may direct attention to copied text. A lockdown browser may block a website. None of these controls proves that the assessment measured the intended knowledge or skill.
This distinction matters during procurement. A dashboard full of red flags can look impressive without showing whether the alerts are accurate, useful, or connected to genuine misconduct.
Institutions should ask vendors what their system misses, not only what it detects.
Where Online Assessment Overreaches
High-Surveillance Tools Are Used for Low-Stakes Work
Webcam monitoring may be defensible for a tightly controlled final examination. It is much harder to justify for routine practice quizzes, formative work, or tasks that could be redesigned as open-book activities.
Room scans are especially intrusive. They may reveal living conditions, family members, religious objects, medical equipment, personal papers, or other information unrelated to academic integrity.
Continuous audio can capture people who are not taking the exam and may not know they are being recorded.
Each category of collected data should have a clear purpose. “The platform records it by default” is not an adequate reason.
Observable Behaviour Is Treated as Evidence of Intent
Automated monitoring can identify that a face moved, sound occurred, or the browser changed state. It cannot reliably determine why.
Students with disabilities, chronic pain, neurodivergence, caring responsibilities, or shared living arrangements may be more likely to trigger behavioural alerts. So may students working with weak cameras, poor lighting, or unstable internet connections.
The European Union’s AI Act adds a legal boundary for institutions within its scope. Its prohibition on emotion-recognition systems in education has applied since February 2025, apart from limited medical or safety uses. Institutions should be wary of products that claim to infer nervousness, attention, honesty, or emotional state from biometric signals.
Privacy Notices Replace Real Governance
Students often cannot freely reject a required proctoring platform without affecting their grade or progression. An acceptance box does not settle every privacy or fairness question.
Institutions should know:
- what information is collected;
- why each category is necessary;
- where it is stored;
- who can access it;
- which subcontractors receive it;
- whether it is used to train or improve models;
- how long it is retained;
- how inaccurate records can be corrected;
- what happens to the data when the contract ends.
Under the GDPR, organisations within its scope must have a lawful basis for processing and follow principles including fairness, purpose limitation, data minimisation, security, and storage limitation.
In the United States, FERPA does not automatically resolve every question about an external educational platform. Institutions must examine the service, the records involved, the purpose of disclosure, contractual controls, and restrictions on reuse or redisclosure.
Requirements differ by jurisdiction. A global institution should not copy another university’s privacy notice and assume that the same legal analysis applies.
Technical Failure Is Treated Like Misconduct
A frozen camera, dropped connection, blocked permission, failed update, or depleted battery is a technical incident unless other evidence suggests otherwise.
Students may also be unable to install software on an employer-owned, shared, or centrally managed device. Others may lack a quiet room or dependable broadband.
Policies should explain what happens when:
- the software will not install;
- a student fails the system check;
- the connection drops during the examination;
- the browser closes unexpectedly;
- submitted work is not saved;
- an approved assistive tool conflicts with the platform;
- a medical need requires movement or a break;
- technical support cannot resolve the problem.
Institutions weaken trust when these decisions are left to improvised judgment during an already stressful examination.
A More Defensible Security Model
The following order works better than beginning with surveillance.
1. Define the actual risk
Identify the type of misconduct that could invalidate the result. Consider the stakes, the likely methods, and the evidence required for a fair investigation.
2. Improve the assessment
Use application, explanation, staged work, oral checks, process evidence, or multiple assessment points where these fit the learning outcome.
3. Add the least intrusive effective control
Authentication and question variation may be enough for one assessment. Another may justify a restricted browser or live supervision. The decision should be documented rather than assumed.
4. Publish the rules early
Students should know which resources are allowed, how AI may be used, what data will be collected, what behaviour may trigger review, and how technical incidents will be handled.
5. Test the full setup
Provide a realistic practice assessment, not only a compatibility page. Include a support route and an alternative process for students who cannot use the required setup.
6. Keep people responsible for consequential decisions
Automated tools can organise evidence. They should not determine guilt or penalties.
7. Audit what happens after deployment
Review interrupted exams, failed identity checks, support requests, accommodation problems, flags, misconduct findings, and successful appeals.
A system that repeatedly disrupts honest students is not performing well simply because it appears strict.
Match the Control to the Stakes
For a low-stakes quiz, question variation, open-book rules, feedback, and multiple attempts usually provide more educational value than webcam monitoring.
For a high-stakes course examination, institutions may combine authenticated access, a reviewed question bank, a practice test, reasonable timing, a restricted browser, and human-reviewed event logs. Camera monitoring should be added only when a specific remaining risk justifies it.
For essays, code, reports, and design work, process evidence is often more useful than constant surveillance. Drafts, repository history, source trails, calculations, demonstrations, and oral checks can reveal whether the student understands the work.
For a professional or licensing examination, stronger identity and environmental controls may be justified because an unreliable result could affect public safety or legal authorisation. Even then, candidates need accessible procedures, technical support, privacy information, human review, and a route to appeal.
What to Ask Before Buying a Proctoring Platform
Vendor demonstrations tend to focus on convenience and detection. Procurement teams should spend more time on limitations.
Ask for:
- a complete inventory of collected data;
- the purpose and retention period for each category;
- hosting locations and cross-border transfer arrangements;
- a list of subprocessors;
- evidence supporting identity and behavioural-detection performance;
- accessibility and assistive-technology documentation;
- controls for disabling unnecessary features;
- details of human-review and correction procedures;
- security testing and incident-response arrangements;
- confirmation of whether institutional data is used to train models;
- deletion, export, and contract-exit procedures.
Claims such as “AI-powered integrity” or “fully automated security” should invite more questions, not confidence.
The institution needs to know what the system detects, what it misses, how often it makes mistakes, and what happens to the students it flags.
Final Thoughts
How online assessment prevents cheating has less to do with surrounding every student with surveillance and more to do with collecting credible evidence of learning.
Start by fixing the assessment. Add authentication, technical restrictions, or proctoring only where they address a defined risk. Treat automated flags and detector scores as limited signals, not verdicts. Give students clear rules, technical support, reasonable adjustments, and a fair opportunity to respond.
A secure assessment should produce a trustworthy result without demanding unnecessary access to a student’s home, device, behaviour, or personal data. When an institution cannot explain why a control is needed, what it proves, and how mistakes will be corrected, that control is not ready for use.
FAQs about How Online Assessment Prevents Cheating
Can online exams prevent cheating completely?
No. Online assessment can reduce common forms of misconduct, but no browser restriction, identity check, or proctoring system can control every device, person, or source of outside help. Stronger assessment design, clear rules, and follow-up checks usually provide better protection than relying on one monitoring tool.
Is online proctoring legal?
That depends on the country, the institution’s legal basis, the type of data collected, and how the system is used. Institutions may need to comply with privacy, education-record, accessibility, employment, consumer-protection, or biometric-data laws. They should complete a legal and privacy review before requiring students to use a proctoring platform.
Can a student be penalised based only on a proctoring flag?
An automated flag should not be treated as proof of misconduct. It may reflect movement, background noise, poor lighting, a connection failure, an approved accommodation, or another innocent event. A trained reviewer should examine the full context and allow the student to respond before any penalty is imposed.
Are AI-writing detectors reliable enough for academic misconduct cases?
They are not reliable enough to serve as the only evidence. AI detectors produce probability-based results and can generate false positives or miss edited AI-generated text. Drafts, revision history, sources, earlier work, oral questioning, and the student’s ability to explain the submission provide stronger evidence.
What is the best anti-cheating method for most online courses?
For most courses, the strongest starting point is better assessment design rather than heavier surveillance. Application-based questions, staged submissions, varied datasets, oral checks, and evidence of the working process make misconduct harder while giving instructors more useful evidence of genuine learning.
