How to Handle a Candidate Caught Cheating in a Technical Interview

You caught something. Now what?

Most posts about cheat detection stop at the detection. The actual hard part starts after: a candidate flagged for a 1,200-character paste, a code coherence anomaly, or a typing fingerprint that shifted mid-interview. Your platform did its job. Now you have to do yours — without rejecting a strong candidate over a false positive, and without quietly hiring someone who outsourced your interview.

This post is the operational playbook for the next 48 hours.

Rule zero: flagged is not the same as cheating

The integrity report is evidence, not a verdict. A single severity badge means nothing on its own. Before you do anything else, classify what you actually have:

• Confirmed. Two or more independent signals fire on the same minute, AND the work product itself looks inconsistent (a clean LLM-shaped function in the middle of messier human code, for example). Confirmed almost always means a paste + a coherence break + a behavioral tell (tab switch, off-camera audio, gaze drop).
• Suspicious. One strong signal, with a plausible alternate explanation. Examples: a single big paste that could be boilerplate the candidate wrote earlier, or a tab switch right after submission.
• Noise. Soft signals only — a 200-character paste, one gaze drop, a brief audio dropout. Noise is the default state of any 60-minute remote interview.

If you can't get yourself to "confirmed" or "suspicious" by reading the timeline minute-by-minute, you do not have a cheating case. You have an anxious reviewer. Move on.

Step 1: Freeze the evidence before you talk to anyone

The moment you start asking questions in a Slack channel or a hallway, the story gets noisy. Before that:

1. Export the integrity report as a PDF. ClarityHire's per-signal timeline is hash-stamped at export — you want a snapshot that does not change if the candidate's session record is purged later.
2. Save the work product as it stood at submission, with the timestamps intact.
3. Note your initial classification (confirmed / suspicious / noise) and the specific signals that drove it.

This is not paranoia. If the candidate later disputes the rejection, you do not want to be reconstructing the case from memory.

Step 2: Run the confirmation round before you decide

Almost no hiring decision should rest on async signals alone. Schedule a 20-minute live follow-up framed as a normal next step, not a tribunal. Two questions do most of the work:

1. "Walk me through your solution to problem 2. Why did you pick this data structure, and what would change if the input was sorted?"
2. "Add a single feature to the code you submitted. Take ten minutes."

A real candidate explains their own code fluently and adds the feature. A candidate who did not write it stalls, generalizes, or produces code in a noticeably different style. This is the same pattern as a take-home walk-through — and it works just as well after a flagged async assessment.

Do not mention the integrity flag during this round. You are gathering signal, not building a case. The point is to test whether the work was authentically theirs without telegraphing the question.

Step 3: The three outcomes

After the confirmation round you will be in one of three places.

Outcome A: Confirmed cheating, no ambiguity left

The candidate could not explain their own code, could not extend it, and the live round looks nothing like the submission. You have your answer.

What to do:

• Reject with a neutral, non-accusatory message. Recommended wording: "After reviewing your full assessment, we have decided not to move forward with your application at this time. We appreciate the time you invested."
• Do not explain the integrity flag, accuse them of cheating in writing, or invite a debate. The downside of being wrong about a specific accusation is much higher than the downside of a generic rejection.
• Log the outcome in the candidate record with the linked report. If you suspect interview impersonation (a third party took the test), tag the record so the same identity cannot reappear under a different name.

Outcome B: Strong suspicion, but defensible doubt

Live round was awkward but not damning. Maybe English is not the candidate's first language. Maybe they are nervous. Maybe the paste was real boilerplate.

What to do:

• Run one more high-signal round designed to be AI-resistant. A debugging round on unfamiliar code or a system design discussion are good defaults — both reward judgment over generation.
• Score that round on its own merits. If they clear your rubric bar with no further integrity signals, the original flag goes in the "documented but not decisive" bucket.
• If they fail and integrity signals reappear, treat as Outcome A.

Outcome C: It was a false positive

The candidate explained everything, the live round was strong, and the original signals had reasonable explanations. This happens — especially around paste events, which fire for legitimate reasons (copying boilerplate, autocomplete bursts, candidates who write in their own editor first).

What to do:

• Recalibrate. Note in the integrity report that this signal pattern was a false positive. Patterns like this should feed back into your interviewer calibration — recurring false positives mean a threshold needs tuning.
• Move the candidate forward without flag. Do not subject them to additional scrutiny because the early signal exists; that is how good hires get filtered out.

What never to do

A few things will get you sued, ratioed on social media, or both:

• Do not accuse a candidate of cheating in writing. "Our AI detected that you used ChatGPT" is the worst possible message — it implies certainty you do not have and invites a public response.
• Do not auto-reject based on an integrity score. ClarityHire does not auto-reject from integrity signals by design, and you should not bolt one on. A human reviews every flagged session.
• Do not share the integrity report outside the hiring loop. It contains behavioral data the candidate consented to share for a specific purpose. Treat it like a medical record's scope of use.
• Do not skip the confirmation round to save time. The 20 minutes you save is the exact 20 minutes that protects you from a wrongful-rejection complaint.

The honest framing for your team

Cheating in interviews is now common enough that every hiring loop will encounter it. The goal of an integrity program is not zero cheating — that is unreachable. The goal is:

1. Make cheating expensive (multi-signal detection, live follow-ups, work-sample tests tied to real tasks) so candidates self-select out.
2. Make confirmation reliable (live round before any decision) so you do not over-reject.
3. Make the response boring (neutral rejection, no public accusations) so the program survives one bad call.

Teams who run this loop quietly and consistently catch the obvious cases without false-flagging the rest. Teams who treat every flag as gospel — or who never check at all — both end up with the same result, which is bad hires.

What to do next

If you are setting this up for the first time:

• Configure your integrity layer to strict on senior and security-sensitive roles, basic on early-funnel screens.
• Write a one-page internal SOP using the three outcomes above so reviewers do not improvise.
• Train every interviewer in the confirmation round pattern. It is the single most important skill in the modern interview kit.

A flagged candidate is the system working. What you do in the 48 hours after is the part that determines whether you actually hire well.