Employee time theft: how to spot it and prevent it fairly

Employee time theft is being paid for time not spent working, from padded timesheets and buddy punching to long unreported breaks. On desk-based and remote teams it's usually a symptom of unclear expectations, so the fix starts with clear hours, a written policy and fair, transparent data.

This guide is for managers and HR teams. It explains what counts as time theft for hourly, salaried and remote staff, how to tell it apart from overload or burnout, what it costs with a worked example, how to detect and prevent it without micromanaging, a sample time theft policy clause you can adapt, and a fair process for when you suspect it. It touches wage and termination rules, so read it as general information and check the details with your counsel.

---

Table of Contents

1. What counts as employee time theft?
2. Is it time theft, or something else?
3. What does time theft cost?
4. How do you detect it fairly?
5. How do you prevent it without micromanaging?
6. Sample time theft policy clause
7. What should you do if you suspect time theft?
8. Frequently Asked Questions

---

What counts as employee time theft?

Time theft is knowingly being paid, or claiming pay, for time that wasn't worked. What it looks like depends on how someone is paid and where they work.

Hourly staff

For employees paid by the hour, time theft usually shows up in the time record itself:

• Padded timesheets: recording an earlier start, a later finish or a shorter break than really happened.
• Buddy punching: one employee clocking in or out for another.
• Long unreported breaks: breaks that regularly run past what the policy allows, without being recorded.
• Personal business on paid time: long personal errands, calls or browsing during recorded working hours, beyond what the policy allows.

Short breaks aren't time theft. Under the federal Fair Labor Standards Act (FLSA) rules for non-exempt employees, rest periods running from 5 minutes to about 20 minutes must be counted as hours worked (29 CFR 785.18).

Salaried staff

Salaried employees aren't paid by the hour, so time theft looks different: being unavailable during agreed hours without saying so, spending large parts of the working day on personal matters, or doing undisclosed work for someone else during time owed to you. Pay deductions are rarely the answer here. For exempt salaried employees, federal rules generally require the full salary for any week in which they do any work, with limited exceptions (29 CFR 541.602), so the issue is handled as conduct and performance.

Remote teams

Remote work adds ways to look busy without working:

• Faking presence: keeping a chat status green or using a mouse jiggler, a device or app that moves the pointer, so activity data shows input while nothing is being done.
• Claiming hours not worked: logging a full day on a self-reported timesheet when the work happened in a few hours, or not at all.
• An undisclosed second job during agreed hours: a second job is not a problem in itself, but working it during hours owed to you, or in conflict with your business, is. See what to do if a remote employee has a second job.

What doesn't count: honest mistakes corrected promptly, short breaks, occasional brief personal tasks your policy allows, and work done away from the computer, such as calls, meetings, reading and thinking.

---

Is it time theft, or something else?

Often it isn't. Missed hours and thin output can come from overload, unclear priorities, broken tools, health problems, caring responsibilities or burnout, and they look the same in the data. Rule those out before you treat anything as misconduct.

Burnout deserves a special mention, because its early signs include withdrawal and slipping output, which can be mistaken for slacking. See the 5 early signs of team burnout before you assume bad intent.

The opposite problem is just as real: people working hours they never record. Under the FLSA, work that isn't requested but is "suffered or permitted" is work time (29 CFR 785.11), and management has to see that work isn't performed if it doesn't want it to be (29 CFR 785.13). Fair data shows both directions.

---

What does time theft cost?

Multiply the minutes lost each day by the hourly cost of an employee, the number of working days and the number of employees. Small daily amounts add up, which is why a clear policy is worth the effort, but the figure is a ceiling, not money you can expect to recover.

The formula: minutes a day ÷ 60 × fully loaded hourly cost × working days a year × employees. The fully loaded hourly cost is pay plus employer taxes and benefits; use your own payroll figure, or work it out from a salary with the free employee cost calculator.

A worked example, with assumptions you should replace with your own: a fully loaded hourly cost of $40, 230 working days a year (260 weekdays less 30 days of holidays and leave) and a team of 50.

Two cautions. First, the example assumes every person loses the same minutes every day; in practice a few people account for most of it, and most of your team accounts for none. Second, policing costs money too: a manager with a fully loaded hourly cost of $60 who spends 20 minutes a day checking timesheets uses 20 ÷ 60 × $60 × 230 = $4,600 a year of their own time, and close watching can cost you trust that is harder to price.

---

How do you detect it fairly?

Compare what was recorded with records that don't depend on memory, look for patterns over weeks rather than single days, and treat every gap as a question until you've heard the explanation. Only use data employees were told about.

Signs of time theft in the workplace, and their limits

• Records that don't match each other. A timesheet start time well before the first activity on the computer, or a full day claimed on a day with no recorded work. Check for work away from the computer first.
• Two clock-ins together. Two people clocking in from the same device seconds apart can point to buddy punching, or to colleagues who arrived together and shared a terminal.
• Breaks that keep running long. A pattern over weeks, not one long lunch.
• Steady input with nothing changing. Keyboard or mouse input that runs for hours while the same application and document stay in front, with no switching and nothing produced, can mean simulated activity. It can also mean a long download or presentation.
• Hours with no output over weeks. Recorded time that never turns into delivered work, after you've checked that priorities were clear. For output measures that fit knowledge work, see how to measure employee productivity.

Data has blind spots. Work done by phone, on paper, in a meeting room or in someone's head doesn't appear in computer activity, so low numbers can hide real work. For example, the Intelogos help center notes that work away from the computer isn't tracked, so it lowers the Availability KPI even though real work happened (Availability KPI).

Detection is only fair when employees know the rules and the records exist for everyone. Some states require notice before electronic monitoring, including Connecticut, Delaware, Maine and New York; see employee monitoring laws by state. Covert monitoring to catch someone out damages trust even where it's lawful.

This is general information, not legal advice. Laws vary by location and change often; consult your own counsel before acting on it.

---

How do you prevent it without micromanaging?

Make expectations explicit, put them in a written policy, and use transparent data that employees can see as well as managers, so the record does the checking instead of the manager. Most time theft prevention is clarity, not surveillance.

1. Set clear hours and break rules. Core hours or schedules, how long breaks can be, and how to record time away. Write down schedule changes when you agree them.
2. Write a time theft policy. Say what counts and what doesn't, how records are corrected and how concerns are handled. Use the sample clause below as a starting point and get each employee's acknowledgment.
3. Make honest recording easy. Automatic time capture beats reconstructing a timesheet from memory on Friday afternoon, and an easy way to correct mistakes with a note removes the temptation to round in your own favor.
4. Show people their own data. When employees can see the same record their manager sees, disputes get settled by looking, not arguing.
5. Fix the causes. Unclear priorities, overload and boredom drive more lost time than dishonesty. Rebalance work and clarify goals.
6. Apply the rules to everyone, managers included.

How Intelogos shows time patterns without screenshots

Intelogos is a workforce analytics platform that shows how work time is spent across apps and websites, without screenshots or keystroke logging, and lets managers ask questions about it in plain language. Intelogos doesn't take screenshots. Intelogos doesn't record what people type; it records only whether keyboard or mouse input happened.

• The workday is recorded automatically. The agent records when the workday starts and ends, active and idle periods and the apps and websites used, so nobody has to rebuild a timesheet from memory. Learn more about time and attendance tracking in Intelogos.
• Idle time follows your rules. You set how many minutes without keyboard or mouse activity count as idle, with a separate threshold for communication apps, and whether idle time is saved or discarded. With desktop agents, people can be asked to keep or discard idle time when they return and add a note such as "In a meeting" (idle time).
• Manual changes stay visible. Owners and admins decide whether people may manually add or remove time. Reports can show manually added time in its own column, separate from tracked time, and count full, short, long and absent days against expected hours, with CSV and Excel exports (Reports, settings).
• A day at a glance. The Daily page shows each person's day as a 24-hour activity chart in 10-minute blocks (Daily).
• People can see their own time. Employees with the User role see their own time data, or their full activity and KPIs, depending on an account-wide setting (roles and access).

---

Sample time theft policy clause

Copy this time theft policy clause into your employee handbook or timekeeping policy and adapt the bracketed parts. Have your counsel review it, because wage, break and termination rules vary by state and by employee type.

Time recording and time theft

1. Purpose. [Company] pays employees for the time they work and relies on accurate time records to do it. This clause explains what we expect when you record time, what counts as time theft and how we handle a concern.

2. Recording your time. Record the time you actually work, accurately and promptly, using [timekeeping system]. Record only your own time. If you make a mistake, or forget to start or stop recording, correct it within [Number] working days and add a short note. Corrections are kept with the record.

3. Breaks. Take breaks as set out in [break policy]. Rest breaks of up to [Number] minutes count as paid working time. Meal breaks and other time away from work are recorded as [unpaid breaks].

4. Working outside recorded hours. Don't work off the clock. If you work outside your recorded hours, record that time too. [Company] pays non-exempt employees for all hours they work.

5. What counts as time theft. Time theft means knowingly being paid, or claiming pay, for time not worked. Examples:

• recording time you did not work, or changing a record to show time you did not work;
• clocking in or out, or recording time, for another employee, or asking someone to do it for you;
• taking breaks longer than [break policy] allows without recording them;
• doing personal business or work for another employer during recorded working time, beyond the occasional short personal task that [handbook section] allows;
• using a device, app or script to simulate keyboard or mouse activity so that you appear to be working.

6. What doesn't count. Honest mistakes you correct under point 2, rest breaks under point 3, and work done away from the computer, such as calls, meetings, reading or planning.

7. Records we use. We use timekeeping records [and the work data described in the Employee Monitoring Policy, which employees are told about before it is collected]. We do not use covert monitoring to look for time theft.

8. How we handle a concern. A concern is raised with you privately first, with the records it is based on. You can explain and add information before any decision is made. A person, not an automated system alone, reviews the evidence and decides, and the decision and the reasons for it are recorded in writing.

9. Consequences. Time theft may lead to action under [disciplinary policy], up to and including termination of employment, after you have had the chance to respond. Any correction to pay follows applicable law.

10. No retaliation. [Company] will not retaliate against anyone who raises a concern about time records or pay in good faith.

Sample clause. General information, not legal advice; adapt it with your counsel.

---

What should you do if you suspect time theft?

Check the records first, then talk to the employee before you decide anything, and document every step. Treat a pattern as a question until you've heard the explanation.

1. Check the data. Make sure the records are complete and the settings fit the role: an agent that wasn't running, idle rules that are too strict for someone who spends hours in calls, a time zone mix-up or unrecorded time off can all look like missing time.
2. Look for a pattern. Compare several weeks of records with the agreed schedule and the policy, not with a colleague's hours.
3. Talk privately. Show the specific records, ask open questions and listen. "Your timesheet shows 8:00 starts, but the first work activity is usually around 9:30. Can you help me understand that?"
4. Consider other causes. Overload, health, caring responsibilities or a misunderstanding of the rules. Bring in HR where an accommodation may be needed.
5. Decide under your policy, and document it. Record the facts, the employee's explanation, the decision and the reasons, and keep it consistent with how you've handled similar cases. Let a person make the decision, not a score.
6. Get pay right. Correct the time record, but pay non-exempt employees for the hours they actually worked, and take advice before making any deduction from pay. For exempt employees, federal rules allow an unpaid disciplinary suspension of one or more full days for breaking workplace conduct rules only under a written policy that applies to all employees (29 CFR 541.602(b)(5)).
7. Agree what happens next. Expectations, how they'll be checked and when you'll review them together.

For the wider question of judging whether remote work is getting done, see how to know if remote employees are working.

This is general information, not legal advice. Laws vary by location and change often; consult your own counsel before acting on it.

---

Frequently Asked Questions

What is the 7-minute rule?

The 7-minute rule is the common name for rounding time-clock punches to the nearest quarter hour: 1 to 7 minutes round down and 8 to 14 minutes round up. The phrase itself isn't in the regulation. The US Department of Labor's rule on time clocks, 29 CFR 785.48, accepts recording start and stop times to the nearest 5 minutes, tenth of an hour or quarter of an hour, provided that over a period of time it doesn't result in failing to pay employees properly for all the time they actually worked. The same section says employees who voluntarily clock in early or stay late don't have to be paid for that time if they do no work, and that major differences between clock records and hours actually worked should be discouraged. Rounding under a lawful practice isn't time theft, and state wage laws can add their own rules.

This is general information, not legal advice. Laws vary by location and change often; consult your own counsel before acting on it.

Is time theft hard to prove?

It can be, when the only evidence is one day's record or one manager's impression. It's easier to show a pattern from records kept the same way for everyone over several weeks, such as clock-in times, timesheets, work output and activity data employees were told about, together with the employee's own explanation. For non-exempt employees, employers already have to keep records of hours worked each workday and each workweek (29 CFR 516.2). What makes a case fair also makes it stronger: a written policy the employee acknowledged, data they knew about, the same standard applied to everyone and a documented conversation.

Can you fire someone for time theft?

Often, yes: time theft is commonly treated as misconduct in disciplinary policies, and dismissal can be one outcome. How you can do it depends on the employment contract, any collective agreement, your own policies and state law. The reason must not be a cover for an unlawful one: for the employers they cover, federal anti-discrimination laws bar discharge decisions based on race, color, religion, sex, national origin, age (40 or older), disability or genetic information, and retaliation against someone who complained about discrimination (EEOC). The FLSA also bars firing an employee because they filed a wage complaint (US Department of Labor Fact Sheet 77A). Pay for hours actually worked is still owed. Talk to your counsel before you act.

This is general information, not legal advice. Laws vary by location and change often; consult your own counsel before acting on it.

Is using a mouse jiggler time theft?

It can be, when it's used to be paid for time that wasn't worked or to look available when someone isn't. Your policy should say so in writing, as the sample clause does. But if the work is getting done well and on time, a jiggler usually says more about a measure based on activity than about the person, and the better fix is to judge outcomes.

---

Sources

Every legal statement in this guide was checked on the official source below on October 23, 2026.

• 29 CFR 785.48, Use of time clocks (eCFR): rounding practices and early or late clock punching.
• 29 CFR 785.18, Rest (eCFR): rest periods from 5 minutes to about 20 minutes count as hours worked.
• 29 CFR 785.11, General (eCFR) and 29 CFR 785.13, Duty of management (eCFR): work suffered or permitted is work time.
• 29 CFR 516.2 (eCFR): records of hours worked each workday and workweek for non-exempt employees.
• 29 CFR 541.602, Salary basis (eCFR): full salary for any week with work, and the exception for unpaid disciplinary suspensions under a written policy.
• US Equal Employment Opportunity Commission, Prohibited Employment Policies/Practices: discrimination in discharge and retaliation.
• US Department of Labor, Fact Sheet 77A: Prohibiting Retaliation Under the FLSA: retaliation for wage complaints.
• State monitoring notice laws: see the statutes linked in employee monitoring laws by state.

Intelogos facts come from our help center and privacy policy.