There’s a difference between an algorithm saying “these two images match” and a trained person saying “I reviewed this ID and confirmed it.” One is a data point. The other is evidence. When a result gets challenged, you need evidence. Here’s something worth knowing about online proctoring vendors: they all say they verify identity. What they don’t all mean is the same thing. And that gap, between capturing an image and actually confirming who someone is, is where a lot of programs are quietly sitting on risk they haven’t fully thought through. If you’re currently evaluating proctoring platforms, or you’re starting to wonder what your current vendor actually does when a test taker shows up to an exam, this is for you. We’re going to cover what identity verification in online assessment actually looks like, where automated-only systems run into trouble, and what it takes to produce a result that holds up when it counts. What identity verification actually means in an online exam context

‍
The basics are simple. Identity verification confirms that the person taking your assessment is the person who enrolled for it. Most platforms handle this by asking test takers to hold a government-issued ID up to their camera, capturing a live photo, and comparing the two. What varies, a lot, is what happens after those images are captured. In a fully automated system, an algorithm makes the comparison and moves on. In Integrity Advocate’s human-reviewed system, a trained reviewer examines the ID and live photo after the session is completed, verifying both that the ID is a genuine match and that the same person was there for the entire assessment. That’s a meaningfully different thing.

‍

‍

That might sound like a subtle difference right now. It won’t feel subtle when you’re sitting across from an accreditor, or responding to a candidate appeal, or explaining your identity controls to a regulatory body. “Our algorithm flagged it” and “a trained reviewer verified the ID match and confirmed the same person was present for the entire session” don’t carry the same weight in that room.

The actual threats identity verification is meant to stop

Before you evaluate any solution, it’s worth being clear about what you’re actually protecting against. Identity verification in online assessment is mainly a defence against three things.

Candidate impersonation

Someone other than the enrolled candidate sits the exam. Could be a friend, a sibling, or a professional impersonator hired through a contract cheating service. In high-stakes contexts, professional certification, regulatory licensing, safety-critical credentials, the consequences go well beyond academic dishonesty. They touch public trust in the credential itself. That’s a different kind of problem.

Proxy testing and contract cheating services

Proxy testing is impersonation at scale, and it’s growing. The same infrastructure that made remote work possible made organized contract cheating more accessible too. Professional exam-sitters exist. They’ve been around for years and they’ve gotten more sophisticated as online testing has expanded.

What makes proxy testing particularly hard to catch with automation is that the person attempting the ID check is often well-prepared. They may have a convincing fake or borrowed ID. They may have done this before, for other clients, on other platforms. An algorithm looking for obvious facial mismatches isn’t going to catch someone who’s specifically prepared to pass that check.

{{post-stat-highlight}}

Manipulated or non-standard identity documents

Automated systems compare images. They measure how closely two images match. They’re not built to assess whether a document looks legitimate, whether something about it seems off, or whether the context around the ID presentation is consistent with someone who is genuinely who they say they are.

If you need a recent illustration of just how thin that defense is: a UK nonprofit surveyed around 1,300 children aged 9 to 16 and found that about half believe online age verification checks are easy to bypass. One documented method was drawing a fake mustache on their face with a makeup pencil. A 12-year-old was verified as 15. It worked. Other workarounds included pointing webcams at video game characters and making unusual facial expressions until the software stopped trying. TechCrunch covered it in May 2026.

These are AI systems built specifically for facial verification. A makeup pencil broke them. In an exam context, where a candidate may have a professional credential, a licence, or a career on the line, the motivation to try something is considerably higher; and the workarounds available are more sophisticated than drawn-on facial hair. Automated ID checks in high-stakes assessments face the same fundamental vulnerability, with significantly higher consequences when something slips through.

Beyond outright manipulation, non-standard ID documents from other countries are a real operational headache for automated systems. A document that an algorithm can’t parse correctly – because it looks different from its training data, often gets flagged for the wrong reasons. Not because anything is wrong. Just because it looks unfamiliar. That’s a fairness problem as much as it is a fraud one.

Where automated identity verification falls short

Speed and scale, those are the real advantages of fully automated ID verification. They’re genuine. The problem is that optimising for speed and scale means accepting trade-offs that start to matter the moment your results have any real consequence attached to them.

It produces a log, not a defensible record

When a fully automated system approves an identity check, what it creates is a timestamp and a confidence score. That score tells you how closely two images matched according to the model. It doesn’t tell you that a human looked at the documents and made a judgment call.

The moment an outcome is challenged, that distinction is everything. There’s a big difference between “our algorithm scored the match at 94.3%” and “a trained reviewer examined the ID and the live photo and confirmed the identity match.” One is data. The other is documentation. If you’ve ever had to respond to an accreditor asking about your identity controls, you know which one you want to be holding.

Edge cases aren’t actually that rare

Facial recognition systems are trained on datasets. Those datasets have gaps, and those gaps don’t affect all test takers equally. People with darker skin tones, older candidates, people with facial differences or disabilities, and test takers presenting documents from underrepresented countries, these populations consistently get worse outcomes from automated systems.

In a program serving thousands of test takers across many countries, these aren’t rare edge cases. They’re a predictable share of your assessment cycle. A system that handles them badly is a system that consistently disadvantages specific groups of people. That’s both a fairness problem and a real compliance exposure under frameworks like WCAG and AODA.

Accommodations are invisible to algorithms

A lot of programs serve test takers with documented accommodations. Some of those accommodations affect how a test taker looks at the identity check stage. A test taker with a visual impairment may present their ID differently. Someone with a facial difference may not match their ID photo the way an algorithm expects.

An automated system has no way to know an accommodation exists. A human reviewer can, because that information can be passed to them before the check happens. They apply the context, the check goes smoothly, and the test taker isn’t penalized for something their program already knew about and approved.

What human-reviewed identity verification actually adds

Human review at Integrity Advocate isn’t a fallback for when automation fails. It’s the standard for every single check. That changes what the whole process produces, and what you can do with the results.

Judgment, not just pattern matching

A trained reviewer looking at an ID document and a live photo is doing something different from what a facial recognition model does. They’re not just asking “do these two images match?” They’re assessing whether the identity claim is plausible, taking in the quality of the document, the context of the photo, whether something feels off. That’s judgment. It’s not something you can fully replicate with a model.

It also means programs can explain what happened. Not just cite a score. “A trained reviewer examined the ID and the live photo and confirmed the match” is a sentence a human can understand, investigate, and stand behind.

A record that travels with the session

At Integrity Advocate, every identity check creates a time-stamped record permanently attached to the session. What was verified, when, and by whom. If an outcome from that session ever gets challenged, the identity verification record is already part of the documentation, not sitting in a separate system you have to dig through.

Appeals rarely come with advance warning. Programs that have a complete, human-confirmed record don’t have to reconstruct anything after the fact. The evidence was created at the moment of verification. It hasn’t changed.

Deterrence, not just detection

Here’s something that doesn’t get talked about enough: people behave differently when they know a human is watching. A test taker who knows their government-issued ID will be examined by a trained reviewer before the exam starts isn’t approaching that check the same way as someone who knows it’s algorithmic.

Programs that shift from automated-only to human-reviewed verification consistently see a change in the behaviour of the small slice of candidates who were willing to try something. The check itself becomes a deterrent. You catch less because less gets attempted.

‍

What to look for when you’re evaluating

If you’re shopping around, or starting to question what your current vendor actually does, here are the questions that cut through the noise.

Is a human involved in every check, or just the flagged ones?

A lot of platforms say “human review.” What they mean is that a human reviews AI-flagged sessions only, and only when the algorithm decides something is worth escalating. At Integrity Advocate, a trained reviewer looks at every session after it’s completed, verifying the ID match and confirming the same person was present throughout. That’s the question to ask: is every session reviewed, or only the ones the algorithm flags?

What does the record actually contain?

Ask to see a sample identity verification record. If the answer is a confidence score and a timestamp, that’s an automated log. A defensible record includes the ID image, the live photo, the match determination, who made it, and when. If you can’t show an accreditor a complete documentation trail, the check isn’t giving you what you actually need.

How does it handle non-standard IDs and accommodations?

Ask specifically what happens when a test taker shows up with an ID from a country with an unfamiliar format, or when an accommodation affects how they look at the check stage. If the answer is vague or relies heavily on “the algorithm handles it,” that tells you something important about how these scenarios were thought about when the product was designed.

Where does the privacy risk sit?

Identity verification collects sensitive data. Ask specifically what’s collected, how long it’s retained, and whether it’s used for anything beyond the identity check. If you have GDPR, FERPA, or PIPEDA obligations, and most programs doing anything at scale do, you need clear answers here before you commit.

‍

The bottom line

Automated identity verification is better than nothing. That’s true. But if your program issues results that actually mean something, credentials that affect career progression, licences that protect public safety, certifications that carry professional weight, “better than nothing” isn’t where you want to land.

What you need is a check that creates a record you can stand behind. Something that answers not just “did the algorithm approve this?” but “can we show that a qualified person verified this person’s identity before the exam began?” Those are different questions, and they get different responses from the people who ask them.

The cost of getting identity verification wrong doesn’t show up at the time of the exam. It shows up later, when results are challenged, when accreditors start asking questions, when credential fraud surfaces somewhere down the line. By then, piecing together what happened is hard. Having a complete record from the moment of verification isn’t.

{{post-cta}}

Not all proctoring tools work the same way. Before you compare features, pricing, or integrations, the most important decision is the model underneath the platform. If you get that wrong, everything else falls apart.

There are three approaches to online proctoring. Each has a legitimate use case. Each has a real trade-off. And one of them is consistently misunderstood as the safe middle ground when, in practice, not all hybrid models are equal.

As the market scales, programs are under more pressure than ever to choose the right model. Here is what each one actually means and what it means for your program.

The Three Proctoring Models

1. AI-Only Proctoring

AI-only platforms monitor sessions using algorithms. They track eye movement, audio patterns, browser behavior, and screen activity. When the system detects something outside expected parameters, it flags it. The report goes to your institution. Your team decides what to do with it.

The appeal is real. These tools are low cost, highly scalable, and require minimal vendor involvement. For programs running thousands of low-stakes assessments, that efficiency matters.

49% of students globally participated in online learning by March 2025 — driving demand for proctoring that scales without sacrificing accuracy. Source: Business Research Insights, 2026

The risk is also real. AI-only platforms typically flag 15 to 20 percent of all sessions. Many of those flags are not genuine integrity violations. Without a human reviewing the flag before it reaches your inbox, your team is doing that work. The savings on the tool often do not account for the time your staff spends sorting through incidents.

"When a result is challenged, the answer 'the algorithm flagged it' is not a defensible audit trail."

For programs where outcomes carry weight, that gap is a liability.
AI-only works when stakes are low, volume is high, and your institution has capacity to review flags internally.

2. Live Human Proctoring

Live proctoring puts a trained human proctor in the session in real time. The proctor monitors the exam as it happens, can communicate with the test taker, and can intervene if something goes wrong.

The accuracy is high. The human judgment is present. The audit trail is strong. For high-stakes licensing exams, certification bodies with regulatory requirements, and professional credentials where disputes are foreseeable, live proctoring has historically been the answer.

The trade-offs are scheduling and cost. Test takers need to book a time slot. Proctors need to be available. Per-session pricing adds up quickly at scale. For programs delivering hundreds or thousands of exams across flexible windows, the logistics become unworkable.

48% Of students expressed discomfort with webcam-based monitoring during exams — a signal that the model you choose directly affects learner trust in your program. Source: Business Research Insights survey, 2023

Live proctoring is also more intrusive for the learner. Being watched in real time creates anxiety that can affect performance. For programs that care about the experience of their test takers, that friction is worth accounting for.
Live proctoring works when stakes are high, volume is manageable, scheduling is structured, and real-time intervention is a non-negotiable requirement.‍

3. Hybrid Proctoring: The Model That Varies Most

Hybrid proctoring combines AI monitoring with human review. In principle, it offers the best of both approaches. In practice, it depends entirely on one question: when does the human review happen, and is it mandatory?

Many platforms that describe themselves as hybrid use AI for detection and offer human review as an optional tier or a paid escalation. That is not a genuine hybrid. It is AI-only with an appeal process.

Integrity Advocate is built on this model. Human review is not an upgrade.

Hybrid proctoring with mandatory human review delivers scale without shifting the review burden to your institution.

The Question to Ask Every Vendor

When a flag is raised, who reviews it, and when?

If the answer is your team reviews it, or a human reviews it if you escalate, you are looking at AI-only with extra steps. If the answer is our reviewers examine every flag before it becomes an outcome, you are looking at a genuine hybrid. That question takes 30 seconds and tells you more than a 90-minute demo will.

{{post-cta}}

A student finishes a high-stakes licensing exam. They followed every rule. The automated proctoring system flagged them anyway, unusual eye movement, a glance off-screen, a pause the algorithm found suspicious. This is a common example of AI proctoring false positives. The result gets invalidated.

No human ever looked at the session. No one evaluated whether any of it actually constituted cheating. The outcome went out the door based entirely on pattern-matching software making a call it was never designed to make.

That’s the AI proctoring false positive problem. And it isn’t a software glitch or an edge case. It’s what happens when automated flags are treated as decisions.

What Is a False Positive in Online Proctoring?

A false positive is when a proctoring system flags a test taker for suspected misconduct, and the flagged behavior wasn’t actually a violation.

This happens more than people expect. The behaviors that trigger automated flags are often completely ordinary:

• Looking away from the screen to think through a question
• Moving their lips while reading
• A family member walking past in the background
• Connectivity drops in low-bandwidth environments
• Disability-related behaviors covered under accommodations

A human reviewer with a few seconds of context can usually tell the difference. An algorithm can’t. It sees patterns. It doesn’t see people.

Why AI-Only Proctoring Keeps Generating False Positives

Automated proctoring systems do one thing well: they detect anomalies at scale. They’re fast, consistent, and cheap to run. What they can’t do is evaluate whether an anomaly matters.

Flagging is not deciding. Someone still has to look at what was flagged and make a judgment call about whether it rises to the level of misconduct. When AI-only platforms skip that step, when a flag becomes an outcome without any human ever weighing in, you get false positives baked into your process.

That’s the design flaw. The technology does what it was built to do. The problem is treating its output as something it was never meant to be.

An algorithm identifies anomalies. It doesn’t evaluate them.

The flag is not the decision. That part still requires a person.

What False Positives Actually Cost a Program

The downstream effects of a wrongful flag aren’t abstract. They show up in real ways.

Results that can’t be defended: When an outcome is invalidated based on an automated flag alone, you have no documented judgment to point to, just an algorithm’s output. If that result is challenged in an appeal, a grievance, or a legal proceeding, “the system flagged it” isn’t a sufficient answer.

Liability exposure: Organizations issuing regulated credentials in healthcare, food safety, financial services, and similar fields face real consequences when they can’t substantiate an outcome. One indefensible invalidation can undo years of program credibility.

Trust that erodes quietly: Candidates who feel unfairly flagged, or watch a peer get penalized without explanation, lose confidence in the program. Stanford research published in Cell Press found that over half of writing samples from non-native English speakers were misclassified as AI-generated by automated detectors, while native samples were identified accurately. The same bias risk exists in proctoring systems that act on flags without human review.

Compliance exposure: Privacy regulations in Canada, the EU, and the US restrict what behavioral and biometric data can be collected and how it can be used. Automated systems that collect broadly and act without human review create audit risk, especially where proportionality is a legal requirement.

The AI Cheating Problem Makes This Harder, Not Easier

If false positives were already a challenge with conventional exam conditions, add AI-assisted cheating to the picture and automated proctoring’s limitations get worse.

AI cheating tools, such as answer generators, paraphrasing engines, and real-time lookup, leave no behavioral fingerprint. There’s no eye movement pattern to detect, no device anomaly, no audio signal. A candidate using an AI tool looks identical to one who simply knows the material.

Automated systems have no way to distinguish between the two. Some platforms compensate by flagging more aggressively — which only increases false positive rates. JISC’s 2025 guidance on AI detection found that even a 1% false positive rate across a large institution could generate thousands of wrongful accusations annually, without catching a single genuine case of AI-assisted cheating.

The only layer that can evaluate what an algorithm can’t is a person reviewing the session with context. That’s not a workaround. That’s the whole point.

Which Proctoring Providers Combine AI Monitoring with Human Review?

This has become one of the most common questions from programs evaluating proctoring platforms, and the answer depends heavily on how you ask it.

Many platforms offer human review. Some make it an optional add-on. Some include it at higher tiers. A few build it in by default. The gap between those options is significant: if human review is optional, the vast majority of flagged sessions will never receive it. Flags become outcomes. The problem persists.

The question worth asking isn’t “does this platform offer human review?” It’s: “Does every flagged session get reviewed by a person before any outcome is issued, at every price point, without paying extra?”

How Integrity Advocate Handles This

The platform is built on one principle that addresses the AI proctoring false positive problem directly: a flag is not a decision.

Every session that gets flagged is reviewed by a trained human reviewer before any outcome goes out. Not as a premium feature. Not as an upgrade. As the default, at every price point, for every client.

That review produces something an automated system never can: a documented judgment. A record of what was observed, what was evaluated, and what conclusion was reached. When a result gets challenged, and sometimes they do, that record is what the program defends with.

A few other things worth knowing:

• No download or extension required: candidates start on any device or browser, which eliminates a whole category of friction-related anomalies that trigger false flags
• Privacy-first data collection: only what’s necessary for the stakes involved, GDPR and PIPEDA compliant, with sensitive data deleted within 24 hours
• Full lifecycle coverage: identity verification before the exam, monitoring during, validated results after
• Fewer than 1% of test takers ever need support: a reasonable proxy for how well the experience actually works

{{post-cta}}