How to spot a candidate who had help on a remote test

Start with a clear rule the candidate agreed to

Before anything is monitored, the expectation has to be explicit. Our candidates confirm, in writing, that they will work alone without a phone, calculator, search engine, AI tool, or notes, and that the attempt is monitored. Enforcing a rule you never stated is not a defensible position.

The signals worth looking at

For each attempt we record four things, and any one of them alone means very little:

• Time on each question. A long pause on a hard question is ordinary. A long pause followed by a fast, correct run through several hard questions is a different pattern.
• Answer changes. Reconsidering is normal. Changing an answer once and only ever toward the correct one, across many questions, is not.
• Focus loss. Every time the test window loses focus, and for how long in total. A brief blip is a notification. Repeated departures of ten or twenty seconds during hard questions are the strongest single signal there is.
• Paste attempts. Nothing in the test requires typing, so an attempt to paste text has no innocent explanation.

Read them together, not separately

The pattern that should get your attention is the combination: the window loses focus, the pause is long, and the answer that follows is correct on a question most people miss — repeatedly. One of those three is noise. All three, several times, is a conversation.

Equally worth saying: a high score on its own is not evidence of anything. Some people are simply fast. Treating a strong result as suspicious by default is how you lose your best applicant.

What to do when a pattern shows up

Do not accuse, and do not silently discard. Flag the session for review and offer a fresh attempt with a new code, ideally at a time you have agreed together. A candidate who worked honestly loses twelve minutes and nothing else. A candidate who did not usually declines.

And keep the scope of the monitoring honest with yourself as well as the candidate: timing and focus signals from the test page, nothing else. No screen recording, no camera, no keystroke capture, and no visibility into anything the candidate does outside the test.