Online assessment cheating: different ways and how to prevent them
Online assessment cheating has changed more in the last 24 months than in the previous decade. At its core, it is any action a candidate takes during a remote hiring test that causes the score to misrepresent their actual skill. A candidate in 2022 might have Googled an answer or messaged a friend on Discord. A candidate in 2026 can run a screen-sharing tool that hides ChatGPT from your proctor, paste a problem into Claude, and have working code in seconds — faster than they could read the question aloud. The countermeasures most teams deployed in 2021 are now decorative.
This article covers what online assessment cheating actually looks like in 2026, which of the old methods still matter, and what works to stop it without turning your assessment into airport security for legitimate candidates.
What counts as cheating in an online technical assessment?
Cheating, for our purposes, is any action that causes the assessment score to misrepresent the candidate's actual skill. It includes things teams sometimes wave away — a friend on a second laptop, an LLM running on a phone — and excludes things teams over-police, like using documentation a working engineer would also use.
The honest framing: every assessment is a measurement, and every measurement has noise. The goal is not zero cheating. The goal is a signal strong enough that hiring decisions are defensible.
How online assessment cheating happens in 2026
Cheating in online technical assessments in 2026 falls into seven categories, based on patterns commonly reported across assessment platforms and what we see in our own sessions. The first three are new or newly dominant. The last four are old but not dead.
1. LLM-assisted answers (ChatGPT and similar tools)
The dominant cheating method in 2026. A candidate alt-tabs to ChatGPT, pastes the problem, and either copies the answer wholesale or paraphrases it back into the editor. Variants include:
- Running the LLM on a second device (phone, tablet, separate laptop) outside the proctor's view
- Using browser extensions that overlay LLM responses inside the assessment tab
- Voice-prompting an LLM through AirPods while typing the response
- Using AI screen-overlay tools and audio-assist earpieces — several commercially marketed products in these categories launched in 2025 and are actively sold today
The naive countermeasure — "detect LLM-generated text" — does not work reliably. AI-text detectors — particularly the prior generation of perplexity-based tools — produce disproportionately high false-positive rates on non-native English writing, though newer-generation detectors have narrowed this gap, high false-negative rates on lightly edited LLM output, and most candidates paraphrase enough to defeat detection anyway. For a deeper look at how candidates cheat on technical assessments in 2026, the LLM vector is now the dominant one.
2. Screen-sharing exploits and remote help
A friend or paid service connects to the candidate's machine via TeamViewer, AnyDesk, or a custom WebRTC tool and either takes over the keyboard or whispers answers. The newer variants disguise themselves as Zoom or Teams windows to slip past proctors who scan the taskbar.
Paid "interview-as-a-service" providers — a market we have seen operating in flagged sessions on our own platform — will sit a senior engineer next to the candidate's webcam frame and walk them through the assessment in real time.
3. Identity substitution (proxy candidates)
Someone else takes the test entirely. The candidate either hands over credentials or joins a live session where the proxy controls the screen. This was always a risk; it became material when remote hiring went mainstream and stayed material because most assessment platforms still verify identity only at signup.
This is the failure mode KYC-grade verification is built to catch. Without it, a strong score is just evidence that someone scored well — not necessarily the person you are hiring.
4. Pre-leaked questions
Candidates buy or share question banks on Telegram, Discord, GitHub, and the longer tail of forums. If your assessment uses a fixed set of 20 questions repeated across thousands of candidates, those questions are leaked. Treat that as default.
5. Multiple browser tabs and search
Still common. Still works against any assessment that uses textbook problems with named algorithms. The candidate searches, finds the canonical solution on GeeksforGeeks or LeetCode, and pastes.
6. Calculator, notes, and external devices
A second monitor with notes. A printed cheat sheet under the desk. A phone propped against a coffee mug. The mundane methods have not gone away — they have just become less popular than asking ChatGPT.
7. Collusion across candidates
Two candidates take the same test at the same time, on a call, splitting the questions. More common in campus hiring and high-volume IT services hiring than in senior product-company hiring.
How to prevent online assessment cheating
Prevention works by stacking six layers: question design LLMs struggle with, a deep randomized question bank, session-time identity verification, an AI-driven screening interview, proportional proctoring, and a live review of any take-home. No single layer stops a determined candidate, but the stack raises the cost of cheating enough that most stop trying.
Here is what we have seen work, in rough order of impact for technical hiring.
Design assessments LLMs are bad at
The single highest-leverage move. If ChatGPT can solve your assessment in 30 seconds, your assessment is not measuring engineering skill in 2026 — it is measuring willingness to use ChatGPT.
What LLMs are still bad at, as of late 2025:
- Reasoning over a large, unfamiliar codebase. Ask the candidate to find a bug in 800 lines of working code with three subtle issues, not to write a 40-line function from scratch.
- Debugging with specific failure modes. Give them a function that fails on three specific inputs and ask them to explain why before fixing it.
- Design questions with contextual constraints. "Design a rate limiter" is solvable by Claude in 10 seconds. "Design a rate limiter for our payment gateway given that we cap at 100 RPS per merchant, allow burst credit, and need to survive a Redis failover" requires the candidate to ask questions and reason through trade-offs.
- Verbal explanation of code under follow-up questioning. This is what live interviews are for, and it is why FaceCode and OnScreen exist.
We are not claiming LLMs cannot do these things at all. We are claiming they do them poorly enough that a candidate using one will produce visibly weaker work than a candidate who actually understands the problem. For more on how to structure assessments so ChatGPT does not decide the outcome, the question design is the lever.
Use a question bank deep enough that leaks do not matter
If your bank spans 1,000+ skills with a large question pool and you randomize per candidate, leaks are statistically irrelevant. If your bank has 200 questions and you repeat them across a campus cycle, they are leaked by week two.
HackerEarth's library covers 1,000+ skills and supports randomization across the pool, reducing the odds that any two candidates see the same subset. It is not the only deep library on the market, but the depth-plus-randomization principle matters regardless of vendor.
Verify identity at assessment time, not just at signup
This is the gap most platforms still have. The candidate signs up as themselves, then someone else takes the test. KYC-grade verification at the start of each session — government ID match against a live selfie, plus periodic re-verification during long assessments — catches proxy candidates before the score is recorded.
OnScreen does this as part of the interview flow. For any role where the score will materially affect the hiring decision, session-time identity verification should be on.
Use AI interviews for the screening round
A structured AI interview that asks follow-up questions in real time is designed to be harder to cheat than a written assessment. The candidate cannot paste a question into ChatGPT mid-sentence. The avatar can probe — "walk me through why you chose a hash map there instead of a sorted set" — and a candidate who copied the answer will stall.
This is the use case OnScreen (HackerEarth's AI interview product) was built for: high-volume technical screening before a human-led final round, where you need conversational signal but cannot put senior engineers on every screen. It will not catch every cheater — a well-coached candidate who has memorized answers to common follow-ups can still pass. It catches enough of them that the ones who get through to the live round are usually real.
Smart proctoring, used proportionally
Proctoring is the most over-marketed and under-delivered category in this space. Aggressive proctoring — eye tracking, keystroke analysis, full webcam recording, browser lockdown — produces a lot of flags, most of them false positives, and a worse candidate experience.
Proportional proctoring works better:
- For high-volume early screening, light proctoring (tab-switch detection, basic webcam presence, copy-paste flags) is usually enough
- For final-round take-homes, you do not need proctoring at all — pair it with a live walk-through interview where the candidate explains their code
- For high-stakes assessments (finalist round, large compensation bands), full proctoring plus identity verification is justified
The trade-off to name plainly: the more invasive your proctoring, the more good candidates you will lose to friction and the more false-positive flags your recruiters will waste time investigating. Pick the layer that matches the stake. For a deeper look at calibrating proctoring for hiring, see online proctoring tips for fairer technical hiring.
Pair the take-home with a live review
The most underused defense. Whatever the candidate submits, ask them to walk through it on a 30-minute live call. A candidate who wrote the code can explain every decision. A candidate who pasted from Claude cannot explain why they used a particular data structure or what would break under specific inputs.
This works because it shifts the evaluation from "did they produce the right answer" to "do they understand the answer they produced." The second question is the one that actually matters for hiring.
Anti-cheating measures that underdeliver
By underdeliver we mean they cost more in candidate friction, recruiter review time, and false-positive flags than they return in additional cheaters caught.
A few things deserve calling out because they get marketed heavily and underdeliver.
AI-generated-text detectors
Detectors have improved on prose but still produce too many false positives on competent human writing and too many false negatives on lightly edited LLM output. Applied to code, where detection research is far thinner, they are an even weaker signal — not a verdict.
Keystroke biometrics
Promising in theory, though results vary widely by methodology and context and the coding-task evidence base is thinner. Choi et al. (2021), "Keystroke Dynamics-Based Authentication for a Writing Assessment," published by ETS in the Wiley journal ETS Research Report Series, reports an equal error rate of 4.7% on essay-writing tasks. Those results come from controlled settings; in our experience the approach is brittle in real-world remote hiring at scale. Different keyboards, different ergonomic setups, and candidates working in their second language all produce patterns that look like proxy candidates to keystroke models.
Webcam-only proctoring
A camera pointed at a face does not catch a phone running ChatGPT below the desk, an earbud whispering answers, or a second laptop on a side table. Webcam proctoring without screen and environment checks is theater.
"Zero cheating" claims from any vendor
No system catches every cheater — HackerEarth's included. Any vendor claiming otherwise, us or anyone else, is overstating.
How to think about the trade-off
Every defense against cheating costs something — money, candidate experience, time, false positives. The right calibration depends on the role.
For high-volume junior or campus hiring at IT services scale, the priority is fast filtering with reasonable signal. Deep question bank, light proctoring, identity verification, and an AI interview round catches most of what matters without burning recruiter hours on flag review.
For senior product-company hiring where each interview costs five hours of staff engineer time, the priority is making sure the candidate who reaches the live round is real. That means strict identity verification, harder questions LLMs cannot trivially solve, and a live walk-through of any take-home.
For regulated BFSI (Banking, Financial Services, and Insurance) hiring where every decision must hold up to audit, the priority is defensibility under frameworks like RBI guidelines, SOC 2, and the DPDP Act — rubric-based evaluation, full audit trail, KYC-grade identity verification, and proctoring evidence that can be reviewed if a hiring decision is challenged.
The mistake is applying the same anti-cheating stack to all three. Junior campus hiring with airport-security-grade proctoring drops good candidates. Senior staff-engineer hiring with light proctoring lets proxies through. Match the layer to the stake.
Where the cheating arms race is going
Two predictions, based on session patterns we flag on our own platform.
First: question design will matter more than proctoring. We expect the teams that do best over the next two years to be the ones investing in questions LLMs are bad at, rather than the ones investing in surveillance. Surveillance loses to a candidate with two devices. Question design that requires real reasoning is harder to defeat with a tool.
Second: identity verification will become non-negotiable. In our observation of sessions flagged on our own platform, the cost of running a proxy-candidate operation appears to have dropped sharply. The defense — verify the person at session start — is now table stakes for any role where the score will affect a hire.
The teams still relying on 2021 anti-cheat — webcam recording, browser lockdown, copy-paste flags — are protecting against a threat model two generations old.
Next steps
If you are running technical assessments at any scale and have not refreshed your anti-cheating approach in the last 18 months, work through these in order:
- Audit your current question bank this week — search Telegram, Discord, and GitHub for your assessment titles, and identify which questions have named-algorithm solutions an LLM can produce in seconds.
- Turn on session-time identity verification for any round where the score materially affects the hiring decision, starting with finalist stages.
- Add a 30-minute live walk-through after your next take-home batch, where the candidate explains their code and answers follow-ups.
See how OnScreen handles identity verification and structured AI interviews — built for the screening round where most cheating happens and most senior-engineer hours are wasted.
Frequently asked questions
Can AI-generated code be detected reliably in candidate submissions?
No — current detectors are not reliable enough to use as standalone rejection criteria. The more useful question is what you do with a detection flag. Even a detector that fires with high confidence cannot support rejection on its own — even a small false-positive rate, applied across a funnel of thousands of candidates, means dozens of legitimate engineers flagged as cheats, with legal exposure if any are in a protected class. Treat detector output as a trigger for a live follow-up interview, never as evidence sufficient for a rejection.
Is browser lockdown software worth deploying?
For high-stakes finalist rounds, yes. For high-volume early screening, the friction cost usually outweighs the benefit — you will lose more legitimate candidates to setup problems than you will catch cheaters. Browser lockdown also does nothing against a second device, which is the more common cheating vector in 2026.
How do you stop a candidate from using ChatGPT during a take-home?
You do not, fully. What you can do is design take-homes where ChatGPT's output is not enough — multi-day projects with code review questions, integration into an existing codebase, or written reasoning that gets probed in a live walk-through. Treat the take-home as a starting point for a conversation, not a final evaluation.
Does identity verification slow down the candidate experience?
Modern KYC-grade verification typically completes in seconds to under a minute for clean automated checks. The trade-off is real but small. For roles where a proxy-candidate hire would cost more than a strong candidate's annoyance, it is worth it. For very early-funnel screening at extreme volume, some teams skip it and verify only at later stages.
What if our assessment platform is the leaked one?
Assume your questions are leaked unless you have a deep, randomized bank with new questions added regularly. Run a search for your organization's assessment titles on Telegram and GitHub once a quarter. If you find them, rotate the bank — and consider whether your assessment format is too predictable to begin with.







