There’s a difference between an algorithm saying “these two images match” and a trained person saying “I reviewed this ID and confirmed it.” One is a data point. The other is evidence. When a result gets challenged, you need evidence. Here’s something worth knowing about online proctoring vendors: they all say they verify identity. What they don’t all mean is the same thing. And that gap, between capturing an image and actually confirming who someone is, is where a lot of programs are quietly sitting on risk they haven’t fully thought through. If you’re currently evaluating proctoring platforms, or you’re starting to wonder what your current vendor actually does when a test taker shows up to an exam, this is for you. We’re going to cover what identity verification in online assessment actually looks like, where automated-only systems run into trouble, and what it takes to produce a result that holds up when it counts. What identity verification actually means in an online exam context

‍
The basics are simple. Identity verification confirms that the person taking your assessment is the person who enrolled for it. Most platforms handle this by asking test takers to hold a government-issued ID up to their camera, capturing a live photo, and comparing the two. What varies, a lot, is what happens after those images are captured. In a fully automated system, an algorithm makes the comparison and moves on. In Integrity Advocate’s human-reviewed system, a trained reviewer examines the ID and live photo after the session is completed, verifying both that the ID is a genuine match and that the same person was there for the entire assessment. That’s a meaningfully different thing.

‍

‍

That might sound like a subtle difference right now. It won’t feel subtle when you’re sitting across from an accreditor, or responding to a candidate appeal, or explaining your identity controls to a regulatory body. “Our algorithm flagged it” and “a trained reviewer verified the ID match and confirmed the same person was present for the entire session” don’t carry the same weight in that room.

The actual threats identity verification is meant to stop

Before you evaluate any solution, it’s worth being clear about what you’re actually protecting against. Identity verification in online assessment is mainly a defence against three things.

Candidate impersonation

Someone other than the enrolled candidate sits the exam. Could be a friend, a sibling, or a professional impersonator hired through a contract cheating service. In high-stakes contexts, professional certification, regulatory licensing, safety-critical credentials, the consequences go well beyond academic dishonesty. They touch public trust in the credential itself. That’s a different kind of problem.

Proxy testing and contract cheating services

Proxy testing is impersonation at scale, and it’s growing. The same infrastructure that made remote work possible made organized contract cheating more accessible too. Professional exam-sitters exist. They’ve been around for years and they’ve gotten more sophisticated as online testing has expanded.

What makes proxy testing particularly hard to catch with automation is that the person attempting the ID check is often well-prepared. They may have a convincing fake or borrowed ID. They may have done this before, for other clients, on other platforms. An algorithm looking for obvious facial mismatches isn’t going to catch someone who’s specifically prepared to pass that check.

{{post-stat-highlight}}

Manipulated or non-standard identity documents

Automated systems compare images. They measure how closely two images match. They’re not built to assess whether a document looks legitimate, whether something about it seems off, or whether the context around the ID presentation is consistent with someone who is genuinely who they say they are.

If you need a recent illustration of just how thin that defense is: a UK nonprofit surveyed around 1,300 children aged 9 to 16 and found that about half believe online age verification checks are easy to bypass. One documented method was drawing a fake mustache on their face with a makeup pencil. A 12-year-old was verified as 15. It worked. Other workarounds included pointing webcams at video game characters and making unusual facial expressions until the software stopped trying. TechCrunch covered it in May 2026.

These are AI systems built specifically for facial verification. A makeup pencil broke them. In an exam context, where a candidate may have a professional credential, a licence, or a career on the line, the motivation to try something is considerably higher; and the workarounds available are more sophisticated than drawn-on facial hair. Automated ID checks in high-stakes assessments face the same fundamental vulnerability, with significantly higher consequences when something slips through.

Beyond outright manipulation, non-standard ID documents from other countries are a real operational headache for automated systems. A document that an algorithm can’t parse correctly – because it looks different from its training data, often gets flagged for the wrong reasons. Not because anything is wrong. Just because it looks unfamiliar. That’s a fairness problem as much as it is a fraud one.

Where automated identity verification falls short

Speed and scale, those are the real advantages of fully automated ID verification. They’re genuine. The problem is that optimising for speed and scale means accepting trade-offs that start to matter the moment your results have any real consequence attached to them.

It produces a log, not a defensible record

When a fully automated system approves an identity check, what it creates is a timestamp and a confidence score. That score tells you how closely two images matched according to the model. It doesn’t tell you that a human looked at the documents and made a judgment call.

The moment an outcome is challenged, that distinction is everything. There’s a big difference between “our algorithm scored the match at 94.3%” and “a trained reviewer examined the ID and the live photo and confirmed the identity match.” One is data. The other is documentation. If you’ve ever had to respond to an accreditor asking about your identity controls, you know which one you want to be holding.

Edge cases aren’t actually that rare

Facial recognition systems are trained on datasets. Those datasets have gaps, and those gaps don’t affect all test takers equally. People with darker skin tones, older candidates, people with facial differences or disabilities, and test takers presenting documents from underrepresented countries, these populations consistently get worse outcomes from automated systems.

In a program serving thousands of test takers across many countries, these aren’t rare edge cases. They’re a predictable share of your assessment cycle. A system that handles them badly is a system that consistently disadvantages specific groups of people. That’s both a fairness problem and a real compliance exposure under frameworks like WCAG and AODA.

Accommodations are invisible to algorithms

A lot of programs serve test takers with documented accommodations. Some of those accommodations affect how a test taker looks at the identity check stage. A test taker with a visual impairment may present their ID differently. Someone with a facial difference may not match their ID photo the way an algorithm expects.

An automated system has no way to know an accommodation exists. A human reviewer can, because that information can be passed to them before the check happens. They apply the context, the check goes smoothly, and the test taker isn’t penalized for something their program already knew about and approved.

What human-reviewed identity verification actually adds

Human review at Integrity Advocate isn’t a fallback for when automation fails. It’s the standard for every single check. That changes what the whole process produces, and what you can do with the results.

Judgment, not just pattern matching

A trained reviewer looking at an ID document and a live photo is doing something different from what a facial recognition model does. They’re not just asking “do these two images match?” They’re assessing whether the identity claim is plausible, taking in the quality of the document, the context of the photo, whether something feels off. That’s judgment. It’s not something you can fully replicate with a model.

It also means programs can explain what happened. Not just cite a score. “A trained reviewer examined the ID and the live photo and confirmed the match” is a sentence a human can understand, investigate, and stand behind.

A record that travels with the session

At Integrity Advocate, every identity check creates a time-stamped record permanently attached to the session. What was verified, when, and by whom. If an outcome from that session ever gets challenged, the identity verification record is already part of the documentation, not sitting in a separate system you have to dig through.

Appeals rarely come with advance warning. Programs that have a complete, human-confirmed record don’t have to reconstruct anything after the fact. The evidence was created at the moment of verification. It hasn’t changed.

Deterrence, not just detection

Here’s something that doesn’t get talked about enough: people behave differently when they know a human is watching. A test taker who knows their government-issued ID will be examined by a trained reviewer before the exam starts isn’t approaching that check the same way as someone who knows it’s algorithmic.

Programs that shift from automated-only to human-reviewed verification consistently see a change in the behaviour of the small slice of candidates who were willing to try something. The check itself becomes a deterrent. You catch less because less gets attempted.

‍

What to look for when you’re evaluating

If you’re shopping around, or starting to question what your current vendor actually does, here are the questions that cut through the noise.

Is a human involved in every check, or just the flagged ones?

A lot of platforms say “human review.” What they mean is that a human reviews AI-flagged sessions only, and only when the algorithm decides something is worth escalating. At Integrity Advocate, a trained reviewer looks at every session after it’s completed, verifying the ID match and confirming the same person was present throughout. That’s the question to ask: is every session reviewed, or only the ones the algorithm flags?

What does the record actually contain?

Ask to see a sample identity verification record. If the answer is a confidence score and a timestamp, that’s an automated log. A defensible record includes the ID image, the live photo, the match determination, who made it, and when. If you can’t show an accreditor a complete documentation trail, the check isn’t giving you what you actually need.

How does it handle non-standard IDs and accommodations?

Ask specifically what happens when a test taker shows up with an ID from a country with an unfamiliar format, or when an accommodation affects how they look at the check stage. If the answer is vague or relies heavily on “the algorithm handles it,” that tells you something important about how these scenarios were thought about when the product was designed.

Where does the privacy risk sit?

Identity verification collects sensitive data. Ask specifically what’s collected, how long it’s retained, and whether it’s used for anything beyond the identity check. If you have GDPR, FERPA, or PIPEDA obligations, and most programs doing anything at scale do, you need clear answers here before you commit.

‍

The bottom line

Automated identity verification is better than nothing. That’s true. But if your program issues results that actually mean something, credentials that affect career progression, licences that protect public safety, certifications that carry professional weight, “better than nothing” isn’t where you want to land.

What you need is a check that creates a record you can stand behind. Something that answers not just “did the algorithm approve this?” but “can we show that a qualified person verified this person’s identity before the exam began?” Those are different questions, and they get different responses from the people who ask them.

The cost of getting identity verification wrong doesn’t show up at the time of the exam. It shows up later, when results are challenged, when accreditors start asking questions, when credential fraud surfaces somewhere down the line. By then, piecing together what happened is hard. Having a complete record from the moment of verification isn’t.

{{post-cta}}

Your organization spent money on an online safety training program. Employees completed it. You have completion records. You feel confident that if something goes wrong, you can demonstrate due diligence.

You may be wrong.

Courts and regulators are increasingly drawing a distinction between online training that can be verified and online training that cannot. If your platform cannot confirm who completed the training and whether they actually participated, that training may not count when it matters most.

The Standard Has Changed

Workforce training moved from the classroom to the screen gradually, then all at once. The cost savings are real, the scheduling flexibility is genuine, and for many organizations online training is now the only practical option for reaching a distributed workforce.

But the shift to online created a problem that classroom training never had: how do you prove that the right person completed the training, and that they actually engaged with it rather than clicking play and walking away?

In a physical classroom, an instructor can confirm attendance and participation. Online, without the right technology, you cannot. And in high-risk industries, that gap has real legal consequences.

What the Courts Have Said

The landmark case of R. v. Rose's Well Services Ltd. made this problem impossible to ignore. During the investigation, an employee admitted to completing online training on behalf of other employees. The employer had training records. The employer had completion data. None of it mattered, because the records could not demonstrate that the right people had actually done the training.

Courts determining fault in workplace incidents use due diligence as a central test. Did the employer take all reasonably practical steps to prevent the incident? Providing online training that cannot be verified does not satisfy that test.

The legal counsel of a multinational energy company put it plainly:

"Making our safety orientation and training available on the web and requesting that personnel take the training without the ability to provide documented evidence that personnel had actually completed the required safety orientation and training would, in my opinion, not be reviewed positively in an analysis of whether a company had satisfied its due diligence requirements in the event of an incident. Due diligence is a company's only defense against a strict liability offense."

That is not a hypothetical risk. It is a legal opinion from inside a major organization that had already thought carefully about what their online training program would look like in front of a judge.

The Three Risks Unverified Online Training Creates

Someone else completes the training

Without identity verification, there is no way to confirm that the person who registered for the training is the person who completed it. The Rose's Well Services case is not an isolated incident. Proxy completion is a known problem in workplace training, particularly for mandatory compliance courses that employees view as a checkbox rather than a learning opportunity.

The learner clicks through without engaging

Completion records show that a course was finished. They do not show that anyone watched it, read it, or absorbed any of it. A learner who clicks play, leaves the room, and returns to click through the assessment has a completion record identical to one who engaged with every module. In a regulatory investigation, that distinction matters.

The record cannot be defended

Even if training was completed legitimately, an employer who cannot provide documented evidence of who completed it and how they participated is in a weak position. Regulators and courts do not give credit for training that cannot be verified.

What Some Organizations Have Done in Response

Some organizations, including Spectra Energy, have responded to this problem by removing online training from high-risk content categories entirely, citing security concerns around confirming student attendance. That is a significant operational step backward.

The Chartered Professionals in Human Resources of Alberta has taken a different position, advising that technology exists that mitigates the issues facing compromised training by verifying both the identity and participation of trainees.

That technology exists. The question is whether your organization is using it.

What Verifiable Online Training Looks Like

Verified online training confirms three things that unverified training cannot:

• Identity — the person who registered is the person completing the training
• Participation — the learner was present and engaged throughout the session, not just logged in
• Documentation — a record exists that can be produced in a regulatory investigation or legal proceeding and withstand scrutiny

Integrity Advocate has worked with organizations across construction, mining, oil and gas, and other high-risk industries to help hundreds of thousands of personnel complete training online in a way that meets regulatory standards and holds up as evidence of due diligence.

The difference between online training that counts and online training that does not is not the content of the course. It is whether you can prove who did it and that they were there for it.

The Choice Every Employer Needs to Make

Organizations running online workforce training face a straightforward decision. Implement training without identity verification and participation monitoring, and accept the legal and regulatory exposure that comes with it. Or implement training with the technology to verify both, and be able to demonstrate due diligence if it ever matters in court.

With Integrity Advocate, that second option does not require rebuilding your training program. It works with your existing LMS and course content, adding the verification layer that transforms a completion record into a defensible document.

{{post-cta}}

Academic integrity isn’t disappearing. It’s being tested. Generative AI is now part of everyday academic life. Credentials carry increasing weight in employment decisions. At the same time, institutions are navigating a new assessment environment where traditional approaches to exam security no longer fully address modern risk.

What is actually happening with cheating in online courses? How much is AI-assisted behavior influencing academic misconduct? And what reduces risk without compromising privacy, accessibility, or trust?

Large-scale research surveying thousands of students and instructors across North America, conducted by Wiley, provides a clear picture of the current academic integrity landscape. The findings confirm what many institutions already sense: cheating patterns are shifting, AI is accelerating change, and assessment security must evolve accordingly.

Here’s what the numbers reveal, and what they mean for modern online proctoring and credential protection.

Cheating is increasing, particularly in online environments

Academic misconduct is not simply anecdotal. It is measurable, and Wiley’s research reflects this growing trend.

• More than half of students and instructors believe cheating will increase in the coming years
• Nearly 70% of instructors report that up to 30% of their students cheated within the past year
• 86% of instructors say students are more likely to cheat in online courses than in-person

Online and hybrid assessments are now embedded across universities, licensing boards, certification programs, and enterprise training initiatives. However, many online exams were adapted rapidly for accessibility and scale rather than intentionally designed with modern assessment security frameworks in place. When remote testing expands without proportional safeguards, risk expands with it.

The solution is building secure-by-design assessment systems that account for evolving threat models, emerging AI tools, and distributed testing environments.

AI has reshaped academic integrity and changed the threat model

Generative AI is no longer experimental; it is now a common part of the academic experience according to Wiley’s survey data.

• Nearly half of students report using generative AI in their coursework
• 46% of students say AI makes cheating easier
• Instructors consistently cite AI as a growing contributor to academic misconduct

AI tools have made cheating easier to execute, but they haven’t changed why people do it or how behavior shows up when someone is attempting to get away with misconduct. The tactics evolve quickly. The intent does not.

“AI doesn’t replace human intent. It changes how behavior shows up.”

By the time a specific AI tool is identified and restricted, three new ones have already taken its place. That means institutions cannot rely on tool-specific detection alone. They need an approach that focuses on behavior, context, and patterns of engagement rather than chasing software names.

How Integrity Advocate Responds: COUNTER-AI™

Integrity Advocate’s COUNTER-AI™ approach recognizes that AI changed the tactics, not the intent.

Rather than attempting to block or identify every possible AI tool, COUNTER-AI™ focuses on the human signals that surface during an assessment, how someone engages with the exam, how they navigate through content, and how participation patterns align with expected behavior. This behavioral, security-based framework allows institutions to identify risk without over-policing legitimate AI-assisted learning.

Combined with trained human review, COUNTER-AI™ ensures that institutions can respond proportionally and fairly. Instead of reacting to every new AI platform that emerges, Integrity Advocate adapts to the underlying behavior patterns that persist regardless of the tool being used.

The result is a modern assessment security strategy that keeps pace with AI without becoming invasive, brittle, or dependent on outdated detection lists.

Students confirm what prevention experts already know: accountability reduces cheating

Wiley’s research shows that students say they are less likely to cheat when safeguards and expectations are clear.

• 81% say grade impact would deter cheating
• 81% say serious academic consequences would deter cheating
• 69% say proctoring during online exams reduces misconduct
• 62% say clearly explained consequences reduce cheating

The takeaway isn’t that students need harsher punishment. It’s that visibility changes behavior.

In most security environments, incidents are prevented not by catching someone in the act, but by being visibly present before anything happens. The same principle applies to assessments. When oversight is real, consistent, and clearly communicated, behavior shifts before there is anything to investigate.

Security isn’t about catching people. It’s about creating an environment where integrity is the default.

Integrity Advocate embeds accountability directly into the assessment lifecycle so that presence is established from the beginning. Identity verification confirms the right individual is taking the exam, and participation monitoring creates transparency throughout the session without resorting to invasive surveillance. Students understand that the assessment environment includes thoughtful oversight, which reduces temptation while maintaining dignity.

At the same time, context matters. One unusual moment during an exam rarely tells the full story. What matters more are patterns, how someone typically moves through questions, how they engage with the screen, how their behavior aligns with expected participation. When those patterns meaningfully deviate, insight becomes clearer. Patterns of behavior reveal intent in ways tools alone never can.

By combining AI-assisted behavioral analysis with trained human review, Integrity Advocate evaluates exams in context rather than reacting to isolated blips. This ensures institutions receive fair, defensible insight while avoiding automated accusations or rigid triggers.

Because the approach is privacy-forward and human-reviewed, students experience structure without intimidation, and institutions gain deterrence without overreach. Accountability becomes part of the system itself, embedded in design rather than layered on after misconduct occurs.

Instructors are concerned about learning outcomes, not just rule enforcement

According to Wiley’s data:

• 67% of instructors worry students are not truly learning the material
• 55% worry students will not be prepared for real-world careers
• 49% worry students will not be prepared for future coursework
• Yet only 16% use cheating detection or prevention tools

When exams are compromised, the consequences extend far beyond the classroom. Unqualified individuals can enter regulated industries such as healthcare, financial services, cybersecurity, and public safety, putting organizations and communities at risk. Protecting exam integrity protects individuals, programs, the workforce, and the public.

And yet, despite the stakes, adoption of comprehensive assessment security remains uneven.

Instructors care deeply about outcomes and readiness, but many hesitate to adopt solutions that feel intrusive, complex, or operationally heavy. They want protection without friction. They want integrity that supports learning rather than disrupting it.

Integrity Advocate approaches assessment security holistically, before, during, and after the exam.

Before the assessment, seamless LMS integration keeps the experience simple for instructors and administrators. Identity verification ensures the right person is testing and reduces impersonation risk without adding complexity.

During the session, AI-assisted monitoring paired with human review minimizes false positives and provides contextual, defensible insight. This saves instructors time and preserves fairness. After the exam, audit-ready reporting supports accreditation, compliance, and appeals with documentation institutions can trust.

The future of academic integrity

Online learning is not temporary. AI is not temporary. Remote certification, licensure testing, and workforce credentialing will continue to expand. The institutions that succeed in this environment will be the ones who modernize assessment with intention and embed integrity into every stage of the process. Academic integrity is no longer about isolated detection. It is about designing systems where the right person earns the credential, earns it legitimately, and can stand behind it with confidence. These dynamics play out distinctly in programs where balancing assessment security and privacy requires careful calibration. That is the future of assessment security, and it is the future Integrity Advocate is building.

Source: Wiley, The Latest Insights into Academic Integrity: Instructor and Student Experiences, Attitudes, and the Impact of AI. Survey of 2,900+ students and instructors across North America.
https://www.wiley.com/en-us/publish/ai-insights/the-latest-insights-into-academic-integrity-instructor-and-student-experiences-attitudes-and-the-impact-of-ai-2024-update/

{{post-cta}}