Top 11 Strategies to Prevent Cheating During Testing
This article focuses on pre-employment technical assessments; academic proctoring platforms involve additional controls not covered here. In 2020, cheating on an online assessment meant opening a second tab; in 2026, it means running a stealth AI copilot that feeds answers through an overlay invisible to screen share. In March 2025, CNBC reported on a student-built tool helping candidates cheat in Google and other tech coding interviews, prompting Google to consider a return to in-person interviews (CNBC, March 2025).
The cheating threat in 2020 was narrower - primarily tab-switching and copy-paste. Today, the threat is a candidate running ChatGPT in a second window, using a stealth browser extension that feeds AI-generated answers through an invisible overlay, or paying a proxy service to complete the entire assessment.
Before AI-powered desktop copilots became widely available, browser-based tab monitoring was often sufficient to screen candidates. In 2026, proctoring software is often the difference between hiring a capable developer and hiring someone skilled at prompting an LLM.

HackerEarth's internal platform data shows proctoring adoption rising steadily through 2025 among customers using the feature.
Why cheating on online assessments got harder to detect in 2026
Online assessment cheating became harder to detect in 2026 because purpose-built SaaS tools moved the threat from browser-tab tricks to desktop-level AI overlays that standard proctoring cannot see.
Several paid SaaS applications are now built specifically to help candidates beat technical interviews. They are not crude hacks - they are polished subscription services with onboarding flows, support documentation, and "undetectable" marketing claims.
The strategies below cover ten specific cheating tactics — ordered from the oldest and most basic to the newest and most sophisticated — plus an eleventh overarching layered-defense strategy that ties them together. The first six are updated versions of classic cheating methods. The last four are AI-era tactics that have emerged more recently.
Note: references to recruiter and candidate community discussions throughout this article are anecdotal community reports, not measured studies.
10 cheating tactics to defend against — plus one layered-defense strategy
The ten numbered tactics below are the cheating methods to defend against, each paired with the controls that address it. The eleventh item is the overarching layered-defense strategy that combines them.
1. Switching tabs to look up answers
The classic. A candidate opens a new browser tab, searches for the answer, and switches back. It is the oldest trick in online assessments and, ironically, the easiest one to catch in 2026. Most candidates still try it because they assume the assessment platform only records their answers, not their browser behavior.
Why it still happens: Candidates underestimate how much metadata the platform captures. A quick tab switch feels invisible.
How to stop it: Full-screen mode enforcement prevents the candidate from navigating away without triggering an alert. Automatic tab-switch detection logs every instance and can trigger automatic logout after a set number of violations. Custom timers on MCQs add time pressure that makes switching impractical. HackerEarth's proctoring system flags every tab switch and surfaces it in the recruiter's review dashboard.
2. Copy-pasting code from another source
Still the most common technical assessment cheating method. The 2026 variation: candidates copy from ChatGPT directly into the code editor rather than from Stack Overflow. The source has changed, but the mechanic is the same.
Why it is harder to catch than it looks: Modern clipboard managers on Windows and macOS let candidates store multiple copied snippets and insert them with a single keystroke. The paste itself takes less than a second.
How to stop it: Copy-paste restriction in the code editor can block the action outright or flag it for reviewer follow-up — choose blocking for high-stakes assessments and flagging for screening rounds. A plagiarism checker compares every submission against the full corpus of candidate answers for the same test. Code playback records every keystroke as a video. A copy-paste event appears as a single large insertion rather than iterative typing, making it immediately visible during review.
3. Getting someone else to take the test (impersonation)
The friend-takes-the-test scenario is increasingly offered as a paid service. Proxy test-taking services now advertise "managed assessment completion" as a paid offering, complete with professional developers who specialize in clearing top-of-funnel code screens.
Why it is harder to catch than it looks: Unlike tab-switching or copy-pasting, impersonation leaves no in-test behavioral fingerprint unless you verify identity throughout the session.
How to stop it: Randomized webcam snapshots capture the candidate's face at unpredictable intervals during the session. IP-based session restrictions can limit the test to a single network. Webcam-based candidate verification at session start can compare the candidate against their registered identity; confirm current scope on the proctoring feature page. For high-stakes assessments, HackerEarth OnScreen offers KYC-grade identity verification as an additional layer (an OnScreen capability, separate from the standard Assessments proctoring stack). See HackerEarth's guide on remote proctoring for online assessments for configuration details.
4. Looking at a second screen, phone, or notes
A secondary device hidden just out of the webcam's view. The 2026 angle: candidates now prop a tablet beneath the desk running ChatGPT, glancing down periodically to read AI-generated answers.
Why it is harder to catch than it looks: If the device is positioned below the webcam frame, it is physically invisible to a standard webcam capture.
How to stop it: Randomized webcam snapshots can catch candidates mid-glance, and reviewers can spot sustained off-screen focus by scanning through the captured frames. Full-screen enforcement and tab-switch monitoring flag any attempt to consult on-device notes.
5. Having someone in the room help
A friend whispering answers, a partner reading prompts off-camera, or a study group collaborating in the same room. The helpful accomplice has always been a risk with remote proctored assessments, and it remains difficult to catch without additional monitoring.
Why it is harder to catch than it looks: If the second person stays out of the webcam frame and speaks quietly, visual proctoring alone will not catch them.
How to stop it: Randomized webcam snapshots occasionally capture a second person moving through the frame. A plagiarism checker catches identical or near-identical submissions from candidates who received the same whispered answers. For high-stakes sessions, a live follow-up interview verifies the candidate can defend the submitted work in real time.
6. Restroom breaks and other unmonitored exits
The classic disappearing act. The candidate leaves the frame, consults notes or a phone, and returns. Especially common on longer assessments where a mid-test break feels natural.
Why it is harder to catch than it looks: A candidate who pauses for two minutes looks identical to someone who genuinely needed a break.
How to stop it: Custom timers per question keep the clock running and make extended absences costly. Session-level alerts can flag the session when a candidate leaves the webcam frame, and configurable auto-logout thresholds can end the session after a set number of absences — typical thresholds are two to three events for high-stakes tests. Full-screen lockdown ensures that leaving the test screen flags the session.
7. Using ChatGPT, Claude, or other LLMs in a separate window (NEW for 2026)
This is the dominant cheating tactic in 2026. A candidate runs an LLM in a second browser window or a dedicated desktop app, types the question in, receives a solution, then retypes or paraphrases the AI output into the assessment editor. Tab-switch detection catches the obvious version. The harder version: the candidate uses an entirely separate device, making browser-level detection useless.
Why it is harder to catch than it looks: Anecdotally, on r/jobs, threads ask "Is using ChatGPT during an online assessment cheating?" with many candidates arguing it is not. The normalization of AI tools means candidates are less likely to feel they are doing anything wrong. And second-device usage bypasses all browser-level monitoring entirely.
How to stop it:HackerEarth's Smart Browser is a desktop application intended to restrict the candidate's system for the duration of the assessment. Unlike a generic lockdown browser that only restricts the browser tab, Smart Browser is designed to prevent candidates from switching to a ChatGPT window, a desktop AI app, or other applications while the test is active (see the Smart Browser feature page for the current capability list). Code playback analysis can reveal patterns consistent with AI-generated code: long blocks inserted at once versus iterative, exploratory coding with corrections. Plagiarism detection compares the current submission against the candidate's other work to flag inconsistencies.
8. Real-time interview copilots (NEW for 2026)
Stealth browser extensions and overlay applications that listen to interview audio, transcribe questions in real time, send them to an LLM, and feed answers back to the candidate through an on-screen overlay invisible on screen share. These tools are explicitly marketed as "undetectable."
Why they are dangerous: The candidate appears fully engaged. They look at the screen, type, and respond at a natural pace, but they are reading AI-generated answers from an overlay that standard screen-sharing software does not capture. Based on community reports on r/recruiting, employers anecdotally share frustration about candidates who perform brilliantly in live interviews but struggle with basic tasks on day one. These copilot tools are a likely explanation.
How to stop them: Smart Browser (described above) is designed to extend the same desktop-level restriction to overlay applications during the session. Code playback can expose the giveaway pattern: no exploration, no errors, no iteration, just clean code appearing in complete blocks. Live FaceCode interviews with system-design diagram questions force on-the-fly thinking that these copilot tools cannot easily replicate.
9. AI-based code generation tools embedded in IDEs (NEW for 2026)
IDE-embedded AI auto-completion tools run locally on a candidate's machine. If the assessment allows candidates to use their own IDE (common with take-home tests), AI auto-completion operates invisibly. The candidate types a comment describing what they need, and the IDE generates the implementation.
Why it is harder to catch than it looks: The code appears to be typed normally. There is no copy-paste event, no tab switch, no external application. The AI is embedded inside the development tool itself.
How to stop it:HackerEarth Assessments uses its own browser-based IDE, which reduces exposure to IDE-embedded AI tools — a distinct control that generic lockdown browsers running against a candidate's local IDE cannot provide. The same desktop restriction is designed to discourage candidates from opening a local IDE alongside the test. Code playback analysis can help reviewers spot inhuman typing patterns, such as perfectly structured code produced faster than typical human output.
10. Virtual machines and screen-sharing tools (NEW for 2026)
A candidate runs the assessment inside a virtual machine, then has an accomplice remotely access the host machine and complete the test. Alternatively, they use remote-desktop or screen-sharing applications to let a friend control the keyboard in real time. This is a growing concern for remote take-home tests.
Why it is harder to catch than it looks: From the assessment platform's perspective, everything looks normal. The correct candidate appears to be taking the test in a standard browser. The remote access happens at the operating system level, below what a browser-based tool can see.
How to stop it: Smart Browser aims to detect virtual machine environments at session start and block the assessment from loading when a VM is identified. IP-based session monitoring flags unexpected network changes. Plagiarism detection and code playback add a post-submission signal when the on-screen behavior looks clean but the underlying work does not match the candidate's other output.
11. Layered proctoring as the overarching strategy
No single control catches every tactic above. Tab-switch detection misses second-device use; webcam snapshots miss AI-generated code; plagiarism checking misses impersonation. The eleventh and most important strategy is to combine identity verification, desktop restriction, in-test monitoring, and post-submission analysis into a single layered stack so that a tactic bypassing one layer is caught by another. The layered approach — rather than any individual feature — is what makes proctoring reliable in aggregate, and the four-layer framework below describes how the pieces fit together.
What a layered proctoring stack should cover
The tactics above range from basic (tab switching) to sophisticated (stealth interview copilots). No single proctoring feature catches all of them. A workable proctoring stack covers four layers, each addressing a different category of cheating.
Layer 1: Identity and environment verification. Before the assessment begins, this layer confirms who is taking the test and where they are taking it. Controls include webcam-based candidate verification at session start, randomized webcam snapshots throughout the session, and IP-based session restriction. Together they establish a verified baseline before the candidate touches the first question.
Layer 2: Browser and device restriction. This is the layer that separates modern proctoring software from legacy tools. Desktop-level restriction applications run as native applications rather than browser extensions, which positions them to address AI-era tactics that browser-tab lockdowns cannot — such as restricting other applications, flagging virtual machine environments, discouraging screen-sharing tools, and restricting copy-paste. A traditional lockdown browser only controls the browser tab, leaving the rest of the desktop unprotected. That distinction matters because the most dangerous cheating tools in 2026 operate at the application layer, not the browser layer.
Layer 3: In-test behavior monitoring. During the assessment, continuous monitoring flags suspicious behavior for reviewer follow-up rather than making autonomous decisions. This includes tab-switch alerts with configurable thresholds, full-screen mode enforcement, custom MCQ timers that add time pressure, and configurable session alerts when the candidate leaves the webcam frame.
Layer 4: Post-submission analysis. After the test, automated analysis catches cheating that was not flagged during the live session. A plagiarism checker compares every submission against the full corpus of candidate answers for the same test. Keystroke-replay analysis offers full playback showing exactly how the code was written, which reveals code that appears in large complete blocks rather than iterative development.
How HackerEarth maps to this model: HackerEarth implements this four-layer model through its proctoring stack, with Smart Browser handling Layer 2 desktop restriction and KYC-grade identity verification available separately through HackerEarth OnScreen for high-stakes assessments.
These four layers work together. A candidate who bypasses one layer (for example, by using a second device to dodge browser-level controls) can still be caught by another (webcam snapshots capturing off-screen focus, code playback revealing patterns consistent with AI-generated code).


Online proctoring software: trade-offs and what tends to work
No remote proctoring software catches every case, and the goal is not perfect prevention. It is raising the cost and difficulty of cheating high enough that the return does not justify the effort. Each additional proctoring layer increases the resources a cheater must invest, and at some point the investment exceeds the payoff.
A common approach is tiered proctoring. For low-stakes screening assessments, full-screen enforcement, plagiarism detection, and tab-switch monitoring provide adequate coverage without adding friction for honest candidates. For high-stakes final-round assessments, Smart Browser combined with webcam snapshots and code playback offers stronger coverage. For live interviews, FaceCode pair-programming sessions — where the candidate writes code, explains their reasoning, and responds to follow-up questions in real time — remain the strongest verification because no async cheating tool works there.
A few practical points apply regardless of the tier. Communicate proctoring rules to candidates before the assessment begins; transparency reduces the intent to cheat and improves the overall candidate experience. Use behavioral flags rather than punitive automated decisions — flag suspicious activity for human review instead of auto-rejecting candidates. And layer multiple controls instead of relying on any single feature; the strongest proctoring is the combination, not any individual tool.
Where the stack has gaps: Smart Browser and webcam proctoring can be defeated by a determined candidate using an entirely separate physical machine on a different internet connection, positioned outside the webcam's frame. Browser and desktop-level controls cannot see that second machine. The mitigation for this gap is a combination of randomized webcam snapshots and — for final-round decisions — a live FaceCode interview where the candidate has to write and explain code in real time. Live interviews remain the strongest verification of real skill and serve as the final-round ground truth for what async assessments surface. For deeper guidance, see HackerEarth's remote proctoring guide.
Conclusion
The cheating playbook has changed. Tab-switching and copy-pasting were the threats in 2020. In 2026, the threats are ChatGPT, stealth interview copilots, IDE-embedded AI, and professional proxy services. Your approach to how candidates cheat online assessments needs to account for all of them.
A workable operating principle: assume every candidate has AI assistance available and design your proctoring controls around that assumption. Four layers of defense (identity verification, desktop restriction, in-test monitoring, and post-submission analysis) create coverage that no single feature can deliver alone.
Book a demo of HackerEarth's full proctoring stack →
Frequently asked questions
How do candidates cheat on online assessments?
Beyond the ten tactics covered above, one pattern worth flagging is the hybrid session: a candidate who cheats only on the hardest one or two questions and answers the rest legitimately, making their overall behavioral profile look normal. This is why single-signal proctoring (for example, tab-switch alerts alone) tends to under-flag: the give-away moments are surrounded by authentic work. Reviewing code playback question-by-question, rather than at the session level, surfaces these hybrid cases that summary-level dashboards miss.
Can online proctoring software detect ChatGPT?
Proctoring can detect many forms of ChatGPT use, though not all. ChatGPT used in another browser tab is typically detected via tab-switch monitoring. ChatGPT used on a second device is harder to catch directly, but randomized webcam snapshots and Smart Browser's desktop restriction (which discourages local AI applications from running) raise the difficulty. AI-generated code can be flagged through plagiarism checking and code playback pattern analysis, which reveals code that appears in large complete blocks rather than through iterative development. No single control is guaranteed to catch every instance; the layered stack is what makes detection reliable in aggregate.
How does AI proctoring work in general?
This answer describes AI proctoring systems generically, not HackerEarth's specific implementation. In most implementations, AI proctoring uses computer vision to analyse webcam feeds, audio analysis to detect background voices, and plagiarism detection to compare submissions. The underlying models are typically trained on webcam frames and prior submissions, and most output confidence scores rather than verdicts; vendors generally report that accuracy degrades in low light, with unusual camera angles, or with non-standard input devices. It operates as a flag-then-verify model: the system flags suspicious behavior, and a human reviewer makes the final determination. It is not an autonomous decision system.
Can proctoring software detect a second monitor?
Detection of secondary monitors varies by tool. Desktop-level proctoring applications like Smart Browser can identify multi-monitor setups at session start and warn the candidate to disconnect additional displays before the assessment begins. Browser-tab lockdowns generally cannot see attached displays because they operate above the operating system. For high-stakes assessments, teams often pair monitor detection with randomized webcam snapshots so a reviewer can also spot a candidate glancing at an off-frame screen.
Is using AI during a coding assessment cheating?
It depends on what the assessment instructions say. If the employer has explicitly prohibited AI assistance for the assessment and the candidate uses ChatGPT, Copilot, or a stealth interview copilot anyway, that is cheating in the same sense that any rule violation is. If the assessment permits AI tools (some take-home tests now do), then use is allowed within the stated scope. The practical guidance for employers is to state the rule clearly in the assessment instructions — specify whether AI tools are permitted, which ones, and for which parts of the test — so candidates and reviewers share the same definition of a violation.



