How to verify candidates during online exams

Verifying candidates during an online exam means confirming, at the start and ideally throughout the session, that the person taking the exam is actually the registered candidate, not someone testing on their behalf. For a certification exam specifically, this isn't a nice-to-have; a credential earned by the wrong person isn't just a fairness problem - it's a false professional claim that follows that person into their career.

This guide covers the verification methods available, how to layer them, and how to calibrate rigor to what a specific credential is worth. For the broader certification exam process, see our complete guide to online certification exams.

Why a Single Check Isn't Enough

A common mistake is treating identity verification as one step completed at login and never revisited. Traditional password-and-login authentication alone is increasingly considered insufficient on its own, since credentials can be shared, guessed, or compromised, and a login check says nothing about who's actually sitting at the keyboard once the exam starts.

• A login check confirms access, not identity

  - someone with the right credentials isn't necessarily the registered candidate
• A single verification at the start doesn't protect against mid-exam substitution, where a different person takes over partway through a long exam

• Relying on one method creates a single point of failure

  - if that method is spoofed or bypassed, nothing else catches the impersonation

This is why verification is increasingly treated as a layered process combining multiple methods, not a single gate at the door.

The Core Verification Methods

Certification programs typically draw from a combination of these methods, each addressing a different part of the verification problem.

• Document verification

  - the candidate scans or photographs a government-issued ID, which is checked against registration records

• Facial biometric matching

  - a live photo or short video is compared against the submitted ID and, ideally, a previously verified reference photo

• Liveness detection

  - the system prompts an action (a blink, a head turn) to confirm a real, present person rather than a static photo, mask, or pre-recorded video being used to spoof the check

• One-time codes or credentials

  - a code sent to a registered email or phone ties exam access to something only the actual candidate should be able to receive

• Continuous or periodic re-verification

  - rather than checking once at login, the system re-confirms identity at intervals throughout the exam, catching substitution attempts that happen after the initial check

No single method fully solves the problem alone - document verification catches a different failure mode than liveness detection does, which is why combining several is the standard approach for anything above low-stakes.

Calibrate Verification Rigor to the Credential's Stakes

Not every exam needs the same level of verification, and over-verifying a low-stakes assessment creates friction without a matching benefit.

• High-stakes, professionally significant credentials (licensure, safety-critical certifications) warrant multiple layered methods, document verification, biometric matching, liveness detection, and continuous re-checks throughout the session
• Mid-stakes professional certifications often do well with a strong initial check (photo ID plus a live selfie match) combined with at least one periodic re-check during longer exams
• Lower-stakes internal certifications may reasonably use a lighter approach, a unique login plus a one-time code, without the full biometric layer
• Document why you chose a given rigor level for a given credential, since this reasoning is part of what makes your certification program defensible if a result is ever challenged

The right question isn't "what's the most secure verification method available", it's "what level of assurance does this specific credential actually require."

Watch for Newer Impersonation Threats

Verification technology and impersonation tactics are both evolving, and it's worth being aware of where the newer risk is concentrated.

• Deepfake and synthetic media risks are an emerging concern for verification systems, since a convincing manipulated video or image can potentially fool a check that only looks for a live human face without deeper liveness or anti-spoofing analysis

• Anti-spoofing checks

  - looking for signs of a mask, a photo held up to a camera, or manipulated video are increasingly important alongside basic facial matching, not a replacement for it

• This is an active area of development, not a fully solved problem

  - verification vendors continue updating their methods as impersonation tactics evolve, and a certification program's verification approach should be reviewed periodically rather than set once and left unchanged

Treat this as a reason to periodically reassess your verification approach, not as a reason to distrust the category of biometric verification altogether - the underlying methods remain a meaningful improvement over login-only verification even as they continue to be refined.

Build Verification Into the Workflow, Not as an Add-On

Verification works best when it's a native part of the exam flow, rather than a separate manual process your team has to manage alongside the actual test.

• Automate the initial check wherever possible, so identity confirmation doesn't depend on a staff member manually reviewing every candidate before granting access
• Have a fallback process for verification failures - a legitimate candidate who fails an automated check (poor lighting, an ID scan issue) needs a manual review path rather than automatic disqualification
• Log verification results alongside exam results, since the identity confirmation record is part of the auditable trail behind a credential
• Keep the process as low-friction as reasonably possible for legitimate candidates, since excessive verification friction can itself become a barrier for candidates with disabilities or limited technology access

TunnelQuiz builds email OTP verification and periodic face photo checks directly into the exam flow, so identity confirmation happens automatically at the start and at intervals throughout the session rather than as a separate step your team manages manually. For certification programs needing this built into the actual exam delivery, TunnelQuiz's identity verification features cover the login-and-photo layer directly.

The Short Version

Verifying candidates during an online exam works best as a layered process, document checks, biometric matching, and liveness detection combined rather than relying on a single method, with rigor calibrated to what a specific credential actually requires. Newer threats like deepfakes are pushing verification methods to keep evolving, which means this is an area worth revisiting periodically rather than treating as a solved, static checklist.