Multi-Monitor Detection in Remote Interviews

A second monitor is the single most effective aid for covert assistance in a remote interview. The interviewer sees a clean shared screen on display one while the AI assistant runs on display two. Understanding how this works — and what signals expose it — is foundational for anyone designing an integrity monitoring approach.

Multi-monitor use is not inherently suspect. Most developers work across two or more screens and it would be both unfair and impractical to prohibit them. What matters is what is running on the secondary display and whether focus switches between displays correlate with the arrival of fluent, well-formed answers.

How a second monitor enables cheating

Screen sharing, in its default configuration, shares a specific window or a specific display. A candidate who shares only the coding environment on display one leaves display two entirely invisible to the interviewer. They can run a web browser, a native AI assistant, or a full chatbot interface on that display throughout the session. The interviewer sees clean shared content; the candidate sees AI-generated answers on the monitor the camera does not face.

The more sophisticated version layers on top of this: the candidate uses a window configured to appear on a display that exists in software but not hardware — a virtual display created specifically for the session that is known not to be captured by standard screen-share APIs. We cover that variant in detail in Hidden Overlays: How Invisible Windows Beat Screen Sharing.

The detection signals

Multi-monitor fraud leaves a consistent behavioural trace across several signal categories:

• Display count — the number of connected displays is observable from the OS. More than one display in use during a session is a baseline flag for closer scrutiny of other signals.
• Focus-change events — when the candidate moves focus to a window on a secondary display and back, the timing of those transitions is observable. A pattern of "question asked → focus leaves primary display → focus returns → fluent answer appears" is a strong composite signal.
• Clipboard behaviour — long pastes that arrive shortly after a focus return, whose timing aligns with question delivery, are a secondary confirmation. The clipboard event records size and timing, never content.
• Input timing discontinuity — coding answers that arrive as a single large block after a gap, rather than incrementally as the candidate thinks through the problem, fit the pattern of AI-generated content pasted from an off-screen source.

Asking candidates to share all displays

Requiring full-desktop sharing rather than window sharing is the simplest preventive measure — but it is not a complete solution. Candidates can share all displays and still run an AI assistant on a phone. And requiring all-desktop sharing from candidates with legitimate multi-monitor professional setups imposes friction on the majority to deter a minority. A better approach is to monitor focus events regardless of what the candidate chooses to share, and to treat the full-desktop share as one corroborating factor rather than the whole defence.