Skip to content
← All resourcesTRUSTEXAM RESOURCES

How to investigate impersonation in remote exams

Combine identity checks, presence and device evidence, then refer disputed findings to an authorised reviewer.

Impersonation means that another person takes all or part of an exam. It differs from distraction or a technical interruption and requires evidence about who actually completed the tasks.


A photo at entry does not describe the entire session. Combine an appropriate identity process, presence checks and technical evidence while preserving human review.


Distinguish the scenarios

Another person may start under the participant’s account. A participant may pass the initial check and then be replaced. A substituted video source may be presented instead of a current camera view. An unauthorised helper may also influence answers through another channel.


Each scenario needs different evidence. A head movement or a change in answering speed does not establish impersonation.


1. Define the entry check

The organiser decides which documents and comparison procedure are appropriate. Consider the stakes, participant age and necessary exceptions. Explain the required documents, data use and support route in advance.


TrustExam’s configurable preparation workflow includes options such as a participant photo, an identity document and equipment checks. Confirm the selected settings and what happens if a check fails before rollout.


2. Validate presence and video-source checks

A live-presence check can help distinguish a person from a presented photograph or recording, but it is not a solution to every digital video-substitution scenario. Validate the actual method, supported devices and limitations. Do not promise detection of every form of spoofing without test evidence.


3. Review events during the session

A prolonged absence of a face, another person or an interrupted camera can require clarification. Define when a repeat check is appropriate and what the participant should do. Preserve a reasonable recovery path for ordinary technical problems.


4. Examine technical signals in context

Signs involving a virtual camera, remote access or a changed device configuration must be checked in the selected delivery mode. Use available evidence to identify the relevant part of the session, without treating an unusual working rhythm or accurate answer as proof of impersonation.


5. Make a reviewable decision

Prepare the event time, related images or recordings, technical information and the applicable rule. Reviewers need the context before and after an event and a way to record their reasoning.


Risk signals help prioritise review. An authorised person makes the integrity decision. Disputed findings should follow the published appeal process.


Pilot the whole workflow

Choose the exam type and principal risks, agree identity procedures and exceptions, test representative devices and train reviewers with sample cases. Evaluate errors, review time and support requests before expanding. The duration depends on the programme; a working process matters more than a fixed rollout promise.


Agree data handling

Identify which images, recordings and logs are needed, who can access them and when they are deleted. Confirm the applicable requirements with the people responsible for your programme’s data handling.


TrustExam’s role

TrustExam links participant checks with exam-session materials. The available controls and review workflow depend on the agreed configuration. It supports investigation; it does not replace the organiser’s rules or an authorised decision.


Explore the TrustExam workflow · Review signals and appeals


Related reading

YOUR PROGRAMME. YOUR NEXT STEP.

Let’s explore how this works for you.

Request a demo