Second screens, remote control and AI apps: how candidates cheat in computer exams, and what stops them

A certification centre notices that two candidates in the same lab scored 98% on an exam where the average is 61%. Nothing looked wrong in the room. Later they find out how it was done: one PC had a second monitor cable running behind the desk to a friend in the next room, and the other had a remote-control app that let someone outside type the answers. The invigilator walked past both of them a dozen times.

Computer-based exams remove some of the old ways of cheating, such as notes in a pencil case or answers passed on paper, and add new ones that are invisible from the aisle. This article goes through the tricks organisers actually run into, what exam software can do about each one, and what software cannot do, so you know where to put your invigilators.

Lock the PC only when the stakes need it

Everything in this article about locking a PC applies when candidates take the exam in the ExamQR Exam app in locked mode. That covers lab exams on your local network, and online exams where you require the app instead of a normal browser and require full screen. A plain browser cannot see other programs or other monitors, so a browser-only exam relies on the checks described in section 6.

For an online exam, you choose per session how candidates take it: in any browser, in the ExamQR Exam app, or in Safe Exam Browser. The app and Safe Exam Browser are available on the plans that include locked-browser exams; see pricing.

1. A second screen

The trick. A second monitor, a TV or a projector is connected to the exam PC, either as an extra desktop with notes on it or as a copy of the exam screen that someone else can see and answer from.

What the app does. While the exam is locked, the app counts the displays connected to the PC every few seconds, including duplicated ones. If there is more than one, the exam screen is paused with a message telling the candidate to disconnect the extra display. The exam reopens on its own once only one display is left. The app also warns about extra displays on the session list, before the exam starts.

What still needs you. Check cables behind lab desks before the session, especially in rooms that are also used for presentations.

2. Someone else at the controls

The trick. A remote-control app such as TeamViewer, AnyDesk, UltraViewer, Chrome Remote Desktop or Windows Quick Assist lets a helper outside the room see the screen and type the answers. Or the candidate's PC is itself a Remote Desktop session controlled from somewhere else.

What the app does. During a locked exam the app closes remote-control programs every few seconds. It recognises a program by the name inside the file, so renaming AnyDesk.exe to notes.exe does not help. If the exam itself is running inside a Remote Desktop session, the exam is paused until it is opened on the real PC.

3. The exam inside a virtual machine

The trick. The candidate runs the exam inside a virtual machine (VMware, VirtualBox, Hyper-V and similar). The lock then applies only to the inside of the virtual machine, while the real desktop, with a browser and chat, is one keystroke away.

What the app does. It checks whether the PC is a common type of virtual machine, and if it is, the exam stays paused. If your lab deliberately uses virtual desktops, a technician can switch this check off on those PCs.

4. Chat, a browser or an AI assistant

The trick. A chat window with a friend, a quick web search, or a question pasted into ChatGPT.

What the app does. In locked mode the exam fills the screen and stays on top. The keys that switch away from it, such as Alt+Tab, the Windows key and Alt+F4, are blocked, and the clipboard is cleared if the window loses focus. Every few seconds the app also closes:

• web browsers;
• chat and meeting apps such as WhatsApp, Telegram, Messenger, Teams, Zoom and Discord;
• AI apps such as the ChatGPT, Claude and Copilot desktop apps, and tools that run AI models on the PC itself;
• the usual ways out of a locked screen, such as Task Manager, the command prompt and PowerShell.

When the app closes something, it tells the candidate which program and at what time. If a program cannot be closed, the exam stays paused until it is gone.

What still needs you. No Windows app can block Ctrl+Alt+Del. The list of blocked programs is built into the app, so a tool nobody has heard of may slip through. And an AI assistant on a phone is out of reach of any PC software. That one is for the invigilator.

For practical exams, where candidates must use Word, Excel or a code editor, the app does not lock the screen and only closes the programs that have no place in the exam. That case is covered in practical computer exams.

5. Recording the questions

The trick. Recording the screen or taking screenshots so that the questions can be shared with the next session.

What the app does. On Windows 10 (version 2004) and later, the app asks Windows to leave the exam window out of screenshots and recordings, so a capture shows an empty area instead of the questions. Screen recorders and screenshot tools are closed like the other blocked programs.

What still needs you. A phone camera pointed at the monitor. Phones go in bags at the front of the room, and an invigilator who walks the room sees a raised phone straight away. Having several versions of the paper and drawing different questions for each session makes a photo much less useful. See questions leaked between sessions.

6. Leaving the exam in a normal browser

When candidates take an online exam in their own browser, nothing can stop them opening another tab. What ExamQR can do is notice it and act on it:

• The page records every time the candidate leaves the exam window or tab, and supervisors see the count for each candidate live.
• For each session you choose what happens: allow it, show a warning, or submit the exam automatically after a number of times you set.
• You can require full screen, and on the plans with exam supervision you can turn on screen and camera monitoring and a face check.

Use these for mid-stakes exams. When the result really matters, require the app or Safe Exam Browser.

7. Someone else sits the exam

The trick. A friend signs in with the candidate's code and password.

What helps. In a lab, check ID at the door and seat people according to a seating plan, so the invigilator knows who should be at which PC. Printed sign-in cards make the check quick. For online exams on the plans with exam supervision, you can turn on a face check before the exam starts, either done by the candidate or approved by a supervisor. The ExamQR Exam app itself signs in with a code and password only, so the identity check in a lab is the invigilator's job.

What the invigilator still has to do

The app works on the candidate's own PC. When it pauses the exam, the message is on that candidate's screen, and the app keeps a record on that PC. Nothing is sent to the room server. A paused screen is easy to spot from the aisle, which is one more reason for invigilators to walk rather than sit at the front. If you find a candidate cheating, the supervisor app lets you deduct 25% or 50% of their score, or suspend them from the exam.

Checklist

• High-stakes exams run in the ExamQR Exam app in locked mode, or in Safe Exam Browser.
• Cables checked behind lab desks; only one monitor per PC.
• Phones and smart watches in bags at the front.
• ID checked at the door, candidates seated to a plan.
• Several versions of the paper, so neighbours and later sessions do not get the same paper.
• For browser exams: a rule for leaving the window, told to candidates in advance.
• Invigilators walk the room and know what a paused exam screen looks like.

No software makes cheating impossible, and an exam that claims it does tends to stop looking for it. The goal is to make each trick hard, visible or pointless, and to leave the rest to a person who is paying attention. More on this: secure online exams.