# Impersonation in remote exams: identity checks that actually hold up | ExamFence

Source: https://examfence.com/blog/2026-10-21-impersonation-remote-exams-identity-checks.html

[Home](../index.md) / [Blog](index.md)


October 21, 2026 - ExamFence

**Short answer:** Every remote exam rests on one assumption: the person who logs in is the person enrolled. Impersonation breaks that assumption completely. A substitute test taker, sometimes a professional paid by the hour, answers with their own knowledge, so plagiarism checks, question banks, and timing analysis all see a clean, competent exam. The only place the fraud exists is at the identity layer, which is why check in deserves more design attention than it usually gets.

## One check at the door is not enough

A single photo ID comparison at check in stops casual attempts and almost nothing else. The substitute can be present for check in and swap seats after, or the real candidate can verify and hand over the session. Layered checks answer this: identity at check in, periodic face comparison during the exam, and a short live verification again before submission for high stakes tests.

The layers should be risk matched. A low stakes internal quiz does not need the same treatment as a licensing exam, and applying maximum friction everywhere teaches candidates to resent the process and staff to wave people through. Stakes, attempt history, and any flags from previous sessions should set the level.

## What good verification looks like in practice

Document checks come first: a government ID, checked for basic security features and matched to the booking details. Face matching compares the live candidate against the ID photo and, where it exists, against an enrolment photo taken earlier in a controlled setting. The enrolment photo is the strong anchor, because it predates any exam day arrangement.

Liveness checks close the photo spoofing route, asking the candidate to move, turn, or respond so a static image or a prerecorded loop fails. None of these steps accuses anyone of anything; they are turnstiles, not trials, and presenting them as routine for every candidate is what makes them acceptable.

## Flags, reviews, and the human decision

Automated matching produces scores, not verdicts. Lighting, cameras, ageing, and appearance changes all produce mismatches for honest candidates, so a failed face match should route to a trained reviewer with the enrolment history in front of them, never to automatic failure. Institutions that auto fail on match scores will eventually fail an honest student publicly, and the story will travel.

Reviewers need a clear ladder: recheck with better lighting, compare against more history, escalate to a live video conversation, and only then record a suspicion. Documenting each step protects the institution as much as the candidate, because impersonation findings get appealed and the appeal reads the file.

## Deterrence is a design goal, not a side effect

Most impersonation is arranged in advance, which means it can be deterred in advance. Publishing how identity is checked, including during exam spot checks, changes the substitute's risk calculation; professional stand ins avoid exams where they expect to be compared repeatedly. A clear statement of consequences, stated before booking rather than buried in terms, does the same work.

Finally, audit the system with your own tests. Institutions should periodically run controlled attempts: a swapped seat after check in, a photo presented to the camera, a substitute with the candidate's login. Finding the gaps yourself, on a quiet Tuesday, is considerably cheaper than reading about them in an appeal.

Keep reading: [How long should remote exam recordings and proctoring data be kept?](https://examfence.com/blog/2026-10-21-proctoring-data-retention-privacy-remote-exams.md), [How should extra time and breaks work in proctored online exams?](https://examfence.com/blog/2026-10-21-extra-time-accommodations-proctored-exams.md), and [How do candidates bypass browser lockdown tools during remote exams?](https://examfence.com/blog/2026-10-19-browser-lockdown-bypasses-remote-exams.md) cover the nearby cases in this series.

## Frequently asked questions

### Why is impersonation harder to detect than other cheating?

Because the substitute produces original, competent work in real time. Content based tools look for copying, outside help, or abnormal patterns, and a knowledgeable stand in shows none of them. Only identity verification, before and during the exam, addresses the fraud.

### What is an enrolment photo and why does it matter?

It is a reference photo captured earlier under controlled conditions, such as at registration or a first supervised session. Matching exam day images against it is stronger than matching against an ID photo alone, because the anchor was set before any impersonation could be arranged.

### Should a failed face match mean a failed exam?

No. Face matching is affected by lighting, camera quality, and appearance changes. A low match should trigger human review and additional checks, not an automatic fail. Final decisions need a documented review trail because they are routinely appealed.

### How can institutions deter impersonation before exam day?

By publishing exactly how identity is checked, including random during exam verification, and stating consequences clearly at booking. Arranged impersonation depends on the substitute feeling safe; visible, repeated checks remove that safety.

## See your own numbers.

A free bot-traffic audit shows the human-automated split in your live traffic - no code changes, no commitment.

[Get a free bot-traffic audit](mailto:hello@examfence.com?subject=Free%20free%20bot-traffic%20audit)