Proxy Interviews & Remote-Control Fraud: A Field Guide

In a proxy interview, the person on camera isn't the person doing the work. A stronger engineer drives the session remotely while the named candidate reads along — or simply hands over control entirely. Because the video looks normal, these cases are among the hardest to catch by eye.

The three common patterns

Proxy fraud usually takes one of three shapes: a remote operator typing through screen-control software, a second device feeding answers the candidate relays, or a full handover where the candidate's machine is driven from elsewhere. Each leaves a different fingerprint on the machine.

Method	What's happening	Signal	Severity
Remote-control session	Another person drives the candidate's screen	Remote-access service active; synthetic input device	Critical
Second-device relay	Answers fed from a phone or laptop nearby	Read-then-type timing; long focus-loss gaps	High
Full handover	Machine operated from another location	Unexpected network endpoints; input/clipboard bursts	Critical

The signals that expose a proxy

• Remote-access processes — screen-control software running during the interview is rarely innocent.
• Synthetic input — keystrokes and mouse events injected programmatically rather than typed have a tell-tale, too-regular cadence.
• Network endpoints — connections to remote-control relays that exist only for the session.
• Behavioural gaps — the candidate pausing, listening, then producing answers that don't match their own typing rhythm (see keystroke timing).

Why correlation matters here too

Remote-access tools have legitimate uses, so their mere presence isn't proof. The verdict comes from combination: a remote-control service plus injected input plus an unexpected endpoint, all active during the interview window. That intersection is extremely unlikely to be innocent, and it's exactly what a correlated integrity score is built to surface.