Identity checks before the exam: the impostor is stopped at the door or not at all

Why in exam monitoring misses the substitute

Proctoring flags behaviour: second voices, second screens, eyes leaving the frame, forbidden materials. A substitute produces none of it. They know the material, they sit calmly, they finish in a plausible time. The recording of a proxy exam is the most boring recording in your review queue, which is why institutions that rely on flag review alone discover substitution through whistleblowers and payment trails rather than through their own systems.

The candidate and the substitute need exactly one thing from the institution: a login the exam will accept. Everything in the identity layer is about making that login insufficient on its own. Passwords are shareable by design. Faces matched against a trusted enrolment record are not, short of a lookalike and a level of effort most contract cheating customers will not pay for.

Enrolment is where the trust is created

An exam day face check is only as good as the reference it checks against. If the reference photo was uploaded by the student, unchecked, at registration, the substitute simply enrols their own face and the system then faithfully verifies the wrong person all year. Controlled enrolment closes that: ID presented on camera, face captured live, document authenticity checks on security features and data consistency, and the pair stored as the identity record for the course or programme.

Institutions resist controlled enrolment because it adds friction at the happiest moment of the student journey. The friction is real and it is also the product. A ten minute verified enrolment that students do once replaces a semester of pretending that a password plus a webcam glance equals identity, and it moves the argument with a caught substitute from opinion to record.

Liveness, biometrics, and their honest limits

Liveness checks ask the live person to respond, turn, blink, read digits, so that a photograph or a prerecorded video fails. Presentation attacks evolve in reply: masks, deepfake video injected through virtual cameras, and substitutes who are simply live and present, defeating liveness by being a genuine live human, just the wrong one. That is why liveness and identity matching do different jobs and both are required. Liveness proves a person. Matching proves which person.

Biometric matching carries obligations proctoring brochures underplay: consent, retention limits, breach exposure, and accuracy that varies across populations in ways institutions must test on their own students rather than trust from a vendor average. A false non match locks an honest student out of a high stakes exam. The process needs a staffed fallback, document check by a human, same day, because a system with no appeal route will eventually fail the student it can least afford to fail, on the morning it matters most.

A weekly low stakes quiz does not need the identity stack a licensure gateway exam needs, and overbuilding the light end teaches students to route around you. Tier it: account security and randomised question banks at the low end, verified identity with enrolment matching for high stakes and credential bearing exams, human review of mismatches everywhere. Publish the tiers to students in plain language. Deterrence is half the value of the system, and deterrence only works when the substitute's customer knows the door is watched.

Design the check for the exam's stakes

Then audit your own flags for the substitution pattern specifically: enrolment image changes requested near exam dates, ID check failures followed by passes from different networks, exam locations inconsistent with the student's enrolment footprint. Substitution rarely announces itself in one field. It accumulates in the joins between fields, which is where a reviewer's afternoon is best spent.

Frequently asked questions