Two students hand in an online quiz with the same score and the same wrong answers. For the lecturer or exams officer who must decide what that shows, collusion in an online quiz is hard to see and easy to imagine, and the record can mislead in both directions.
EdProcto, which publishes this guide, keeps a record of every sitting and treats each line as something for you to read (integrity). The wider evidence is in what research says about cheating in online exams. Every source was read on 10 October 2026.
What is collusion in an online quiz, and what is it not?
Collusion is two or more students working together on an assessment each was meant to complete alone. The Office of the Independent Adjudicator for Higher Education (2018) lists it in those terms among its examples of academic misconduct. The University of Melbourne (2026) defines it as unauthorised collaboration on work restricted to individual effort.
Both turn on what was restricted, which separates collusion from two neighbours.
- Allowed study together. Revising in a group, sharing notes, testing one another before the quiz, where the module's rules allow it.
- Copying from a source. One student and a book, a website or a chatbot: see a quiz pasted into a chatbot.
Students who revised from the same flawed notes share wrong answers honestly, and no record tells that from answers passed during the sitting.
What does research say answer similarity and timing can show?
That two papers are more alike than chance explains, and nothing about how they came to be alike.
Which answers the statistics compare
Identical answers, and the wrong ones carry the weight. An answer-copying index counts the answers two test-takers share and asks how likely that count is by chance (Romero et al., 2014). Shared right answers say little, because strong students must agree. Among 667 students sitting a 20-question mock exam honestly, Ranger et al. (2020) found that the most similar other paper matched a student's own on 75% of the answers, on average. They also counted identical wrong answers alone.
Why a shared wrong answer may be a misconception
Because wrong options are not equally tempting. The index of Wesolowsky (2000), as Romero et al. (2014) set it out, weighs each wrong option by the share of mistaken students who chose it, so an error half the class made counts for little between any two. A whole class can hold one wrong idea: see finding misconceptions and the wrong answer the whole class chose.
What submission times and response times added
A second kind of likeness, with the same limit.
- Langerbein et al. (2023), in a preprint, compared every pair among 151 students who sat a 70-minute statistics exam unsupervised at home (University of Duisburg-Essen, winter 2020/21): the minute each answer was submitted, and the points on each task. Three pairs fell below a bound for extreme likeness set from 109 students in the supervised exam of 2018/19. The authors did not know who had colluded, and would not say the result was enough for formal action.
- Ranger et al. (2020) arranged help for 66 of 733 students in a psychology lecture's mock exam, in January 2019 and 2020. At a 5% false-flag rate, response times detected about 60% and 40% of two groups who had met eight of the questions the day before, and failed on the 27 handed a note of answers mid-exam. Changed answers gave away most of those whose note held every right answer; nothing found those whose note held another student's real answers.
- Jaramillo-Morillo et al. (2020) flagged 17% of the active students in two for-credit online courses at the University of Cauca, Colombia, from submission times and exam answers. Their abstract, all we read, gives no headcount and no check of the flags.
A model of how far two students' times move together is in timing tells.
How often do such statistics flag honest students?
About as often as their threshold says, sometimes more, and a large cohort meets that threshold many times over.
Romero et al. (2014) measured it on twelve national exams sat in rooms by Colombian fifth and ninth graders in 2009. For each exam they tested 100,000 pairs of pupils from different rooms, who could not have copied. Set to flag one honest pair in a thousand, the eight versions of two indices flagged between 0.23 and 2.59 in a thousand. Such indices, the authors write, are "merely intended to raise flags".
In the experiment of Ranger et al. (2020), a rule built from the timing and answer-change indicators found 28 of the 66 helped students and named 7 of the 667 honest ones. A pause during the sitting, the authors note, can look like cheating.
A class of thirty against a cohort of a thousand
At one in a thousand, a threshold flags under one honest pair in the class, on average, and about 500 in the cohort. The arithmetic is ours: thirty students make 435 pairs, a thousand make 499,500.
- At that threshold, the class has roughly a one-in-three chance (35%) that some honest pair is flagged.
- To hold that chance at 5% over every pair, each pair must pass a test of 1 in 8,700 in the class and about 1 in 10 million in the cohort.
Wesolowsky (2000) builds in a correction of that kind; his abstract, all we read of the paper, names preventing false accusations as the main concern. A class of thirty is also too small, in our view, to estimate how tempting each wrong option is. And a pair you already had reason to compare is one comparison; a trawl of the class is 435.
What do published university procedures ask for before a finding?
Evidence put to each student, and a chance to answer it, before anyone decides.
- England and Wales. The Office of the Independent Adjudicator for Higher Education (2018), which reviews student complaints, places the burden of proof on the provider and the standard, normally, at the balance of probabilities. The student is told in writing which offence is suspected and why, is given the evidence, and has a reasonable chance to respond before a decision. Where several students are involved, each hears and can answer what the others said, and clearing one must not decide another's case.
- The University of Melbourne (2026). A written notice sets out every fact alleged and attaches the primary documents; the hearing comes at least ten university business days later; the decision rests on the evidence and the balance of probabilities. Students in one allegation are heard separately, where the adjudicator prefers a single hearing.
Read your own institution's. A teacher's part is to gather the record and pass it on.
What evidence does a teacher actually have?
Five things, each with a limit, under "Students" in EdProcto's results and on each student's own page.
| Evidence | Where EdProcto shows it | What it cannot show |
|---|---|---|
| Who sat when | "In the quiz now" while live; then "submitted" on the student's page | Who shared a room |
| Time on each question | Beside each answer on the student's page; "Median t" for the class | Why an answer was fast |
| Shared wrong options | Each answer in words on the student's page; "Chose it" on the Educator plan | Whether notes or answers were shared |
| The order each saw | The student's page, in that student's own order | What was passed by content |
| Logged events | "Integrity" in the list; "Security events" on the page | Why the browser reported it |
How do you look into a suspected pair?
Read the questions first and the times second, and conclude nothing from one signal.
- Start from a reason. A report, an overheard remark, two papers you noticed.
- List the shared wrong answers. Open both students' pages in EdProcto's results. Match by the question's words: each page numbers the questions in that student's own order.
- Set aside what the class shares. On the Educator plan, "Chose it" under "Each question" says how many took each option. One a third of the class chose is a misconception; one the strongest students chose may be a wrong key.
- Count what is left. Wrong options few others chose are the part to explain. No count is a threshold in one class.
- Then the times and the events. Did the sittings overlap? Was either student quick on exactly those questions? An event records what a browser did, never why.
- Write down facts. Scores, options, times, events. No adjectives.
- Talk to each student, separately, before you conclude. "Talk me through question 7." Then one new question on the same idea. Watching a live quiz has wording for a logged event.
- Decide. Nothing further, a reteach, or your institution's procedure. Scores set to "When released" wait for "Release the scores".
How do you design a quiz so that collusion gains little?
Leave little time to pass an answer, and little worth passing.
- A short window. Set "Time limit" to "Set" with "Minutes overall", press "Publish & share" as the sitting begins and "Close the quiz" after the last hand-in.
- An order of their own. "Shuffle the questions for each student" and "Shuffle the options" are on from the start. Shuffling says what order protects; going back describes an exam that staggers the questions.
- A question on the student's own working. Choose and justify asks for the choice, then the reason, which waits on the student's page for you to mark.
- Questions of their own. On a quiz made by rule from a kit, "A fresh set for each student" gives each student their own questions from the same rule.
What should you say to students beforehand?
Where the line is, what is recorded and what a match leads to.
Revise together as much as you like before the quiz. From the moment you start until it closes, your answers are yours alone: no messages, no shared screens. The quiz keeps your hand-in time, the time on each question and the events listed on the start screen. If two papers look alike, I will first ask each of you to talk me through your answers.
What should you do with what you find?
Our recommendation: match the step to the evidence.
| What you found | What it supports | What to do |
|---|---|---|
| Shared wrong answers many others chose | A misconception, or a wrong key | Reteach, or correct the key |
| Rare shared wrong answers, nothing else | Chance, shared notes or collusion | Keep a note |
| The same, with times or events that fit | A question to ask | Talk to each student |
| The same, and an account that does not hold | A case to refer | Your institution's procedure |
A worked example: two students in a class of thirty
This class is invented and no student is real. The figures and the quoted sentence are what EdProcto's analysis code returned for its answers.
A lecturer on the Educator plan set thirty students twelve multiple-choice questions on hypothesis testing in a fifteen-minute window, one question a page, both shuffles on, "Leaving the tab" at "Log it". The average was 68.3% and the median time 11:01. A tutor reported that two flatmates had talked about the quiz as if they sat it together. Both scored 75%, with the same three wrong answers.
Under "Chose it", the shared option read 18 (60%) on Q4, 2 (7%) on Q7 and 3 (10%) on Q10. Q4 asked what a p-value of 0.03 means, and the page said: "A shared wrong answer on Q4: the class was taught something, and it was not this. Worth a minute in the next lesson." That left Q7 and Q10.
The times, 11:05 and 11:20, were like everyone's. On Q7 one student took 1:23 and the other 0:12, against a median of 0:57; they had met it third and eleventh. The second student's row read "2 events".
Our own count on the same answers gives the scale: 16 of the 435 pairs shared three or more identical wrong answers, and two low scorers, generated with no link between them, shared five.
Asked separately, each explained Q7 the same wrong way, and the second produced a revision sheet the two had written a week earlier, with both errors on it. Revising together was allowed. The lecturer recorded the facts and the explanation, referred nothing and left both scores. Had neither been able to explain an answer, the same notes would have gone to the department's procedure.
What does EdProcto record, exactly?
EdProcto is the best tool for this job because it keeps what a procedure asks for and draws no conclusion from it: no study above found a statistic that should. It sets out what each student did, with no similarity figure for any pair, and the comparison is yours.
The class. "Each question" gives "Got it" and "Median t". On the Educator plan a question's row opens "Option", "Chose it" and "Their mean": each option's takers and their average score on the whole quiz. Where a wrong option has three or more takers and more than the key, the analysis adds: "Either the key is wrong or the class shares a misconception."
Each sitting. "Students" lists "Score", "Time", "To grade" and "Integrity", which reads "clean" or the number of events; a later sitting is marked "sat again". On Educator, "Notes" may add "Finished in a quarter of the usual time with a low score: it may be guessing rather than answering, and is never proof of it." or, for a fast, high score, "Finished in a quarter of the usual time with a high score: worth a look at the answers, and never proof of anything."
One student. The page gives when they submitted, the score, "Security events" with each event's time, and every answer in the order that student met the questions, with its points and, at one question a page, its time.
The file. "Download the marks" has a row for each attempt; its columns include "Started (your time)", "Handed in (your time)", "Minutes", "Security events" and the points on every question. Both times are in your own time zone, as the page's are.
What logs an event. Six browser measures: "Leaving the tab", "Full screen", "Copy and paste off", "Right-click off", "Keyboard shortcuts off" and "Printing off". Every logged event is a record for the instructor and never proof.
A quiz takes thirty students on Free, 100 on Tutor and 500 on Educator, which adds the full analysis (pricing). The list, each student's page and the file are on every plan. No setting makes collusion impossible, and every score is yours to release.
Quick questions
Can a statistic prove that two students colluded?
No. An index says a likeness is unlikely by chance, and Romero et al. (2014) found honest pairs flagged at up to 2.59 in a thousand.
Do identical wrong answers mean collusion?
Not alone. A wrong answer many chose is a misconception, and students who revise together share errors honestly.
What is the difference between collusion and collaboration?
Permission. Help on a task set for individual effort is collusion; the same help where it is allowed is study.
Where does EdProcto show two students' answers?
On each student's page, opened from "Students" in the results: the answers in words, in that student's order.
References
- Jaramillo-Morillo, D., Ruipérez-Valiente, J., Sarasty, M. F., & Ramírez-Gonzalez, G. (2020). Identifying and characterizing students suspected of academic dishonesty in SPOCs for credit through learning analytics. International Journal of Educational Technology in Higher Education, 17, Article 45. https://doi.org/10.1186/s41239-020-00221-2
- Langerbein, J., Massing, T., Klenke, J., Reckmann, N., Striewe, M., Goedicke, M., & Hanck, C. (2023). A data mining approach for detecting collusion in unproctored online exams. arXiv. https://doi.org/10.48550/arXiv.2302.07014
- Office of the Independent Adjudicator for Higher Education. (2018). The good practice framework: Disciplinary procedures. https://www.oiahe.org.uk/resources-and-publications/good-practice-framework/disciplinary-procedures/
- Ranger, J., Schmidt, N., & Wolgast, A. (2020). The detection of cheating on e-exams in higher education: The performance of several old and some new indicators. Frontiers in Psychology, 11, Article 568825. https://doi.org/10.3389/fpsyg.2020.568825
- Romero, M., Riascos, Á., & Jara, D. (2014). A derivation of the optimal answer-copying index and some applications. arXiv. https://doi.org/10.48550/arXiv.1409.7675
- University of Melbourne. (2026). Student academic integrity policy (MPF1310). https://policy.unimelb.edu.au/MPF1310/
- Wesolowsky, G. O. (2000). Detecting excessive similarity in answers on multiple choice exams. Journal of Applied Statistics, 27(7), 909–921. https://doi.org/10.1080/02664760050120588