You Caught an Overemployed Worker. Now What?

You have evidence that someone on your team is holding a second full-time job. Before you do anything: you are probably less certain than you feel, the thing you do in the next hour matters more than the thing you do next week, and firing them may not be your best available outcome. This is a practical sequence for handling it.

We sell monitoring software, so treat our advice on confrontation with appropriate suspicion. Our incentive is for you to believe detection is conclusive. It is not, and acting as though it is produces expensive mistakes.

Step one: work out what you actually have

Sort your evidence into three buckets, honestly.

Direct evidence. A second employment contract. A public LinkedIn listing both roles concurrently. The person telling a colleague. A payroll or tax record. This is rare and it is conclusive.

Strong circumstantial evidence. Tracked time overlapping a second employer's known hours. Faked input flagged repeatedly across weeks. Devices or networks that do not match the story. A verification failure pattern — someone else at the keyboard.

Weak signals people mistake for evidence. Low activity levels. Slow replies. Camera off. Declining meetings. Working unusual hours. Every one of these has mundane explanations — caring responsibilities, chronic illness, a different time zone, depression, or simply a job that involves thinking.

If everything you have sits in the third bucket, you do not have a case. You have a suspicion, and the base rate is against you: only about 444,000 Americans work two full-time jobs — roughly 1 in 364 workers. On a 200-person team, if your instinct is right one time in ten, you will accuse about nineteen innocent people to find one real case.

That ratio should govern how you proceed. It is the single most useful number in this article.

Step two: check what you are actually entitled to object to

Read the contract before the dashboard. Employers routinely assume a second job is prohibited when it is not.

Is there an exclusivity or moonlighting clause? Many contracts have none. If yours does not, a second job may be entirely permitted, and your complaint is really about performance — a different conversation with different rules.
Is the clause enforceable where they live? This varies enormously. Several US states restrict employers' ability to control lawful off-duty activity; some jurisdictions void broad exclusivity for non-executive staff. Do not assume a clause works because it exists.
Is there an actual conflict of interest? A second job at a direct competitor is a categorically different problem from a second job at an unrelated company, and usually a much stronger position for you.
Were the hours delivered? If you pay for output and the output arrived, your damages may be zero — which matters if this ever gets argued.

Get employment law input before the conversation, not after it. The cost of an hour of advice is trivially less than the cost of an unfair dismissal claim.

Step three: the things not to do

Most of the damage in these situations is self-inflicted in the first day.

Do not confront in a group. Not in a team channel, not in a standup. Aside from the cruelty, it converts a private employment matter into a public one and hands them a grievance.
Do not cut access first. Locking someone out before a conversation signals a decision already made, and in many jurisdictions that undermines the fairness of whatever process follows.
Do not gather more by escalating surveillance. Ramping monitoring on one individual after suspicion is where employers create genuine legal exposure — targeted, covert, disproportionate monitoring is the fact pattern regulators penalise. Whatever you already collect under your existing policy is what you have.
Do not present it as certainty. "We know you have another job" invites a denial you then have to disprove. If you are wrong, you have poisoned the relationship permanently.
Do not tell their other employer. Tempting, and a fast route to a defamation or tortious interference claim.

Step four: the conversation

One meeting. Their manager and one HR person, no audience. Say what you observed, factually, without an accusation attached, and then be quiet.

"Over the last six weeks, tracked time on your account shows activity patterns our system flagged as simulated input on eleven occasions. Separately, tracked hours on the Anderson project overlap consistently with 9am–5pm Eastern. I want to understand what is happening."

Then let them answer. Three things typically happen:

They explain it, credibly. A macro they use for a legitimate repetitive task. A second timezone. A caring arrangement they never disclosed. If it holds up, believe it, fix the measurement that produced the false signal, and say thank you. This is the most common outcome when the evidence was circumstantial.

They admit it. Now you have a decision to make, and it is not automatically dismissal — see below.

They deny it and the evidence is strong. Now you follow your formal disciplinary process, with everything documented, and with legal input. Do not improvise from here.

Step five: the decision people get wrong

The instinct is dismissal. Sometimes that is right — a direct competitor, falsified billable hours to a client, or a pattern of deception that makes trust impossible.

But run the numbers before you reach for it. Replacing a skilled remote employee typically costs a substantial multiple of their monthly salary once you count recruitment, notice, onboarding and lost delivery. If the person has been delivering acceptable work — and many overemployed people do, which is precisely how it goes unnoticed — you may be about to pay a large sum to punish an outcome you were satisfied with until you learned its cause.

Genuine alternatives, depending on what the contract says and what actually harmed you:

Convert the role. If they are delivering in twenty hours what you scoped as forty, your scoping was wrong. Moving them to part-time or contract can be cheaper and more honest than replacement.
Formalise it. Some employers permit a second job subject to disclosure and no conflict. If your real objection was the concealment rather than the arrangement, disclosure fixes it.
Reset with written expectations. Specific availability, specific deliverables, a review date. Documented, so a repeat is unambiguous.
Recover overpayment, keep the person. If hours were billed that were not worked, recovery may resolve the actual damage.

Choose based on harm done, not on how betrayed you feel on the day. Those two answers are often different, and the second one is expensive.

Step six: fix the conditions that hid it

If someone held two full-time jobs for months without anyone noticing, that is information about your management, not only about them.

Was the workload actually full-time? Frequently the honest answer is no. That is a scoping problem you now know about.
Were you measuring presence instead of output? Overemployment is only invisible where nobody is tracking delivery. Teams with clear deliverables and regular checkpoints notice within weeks.
Did your hiring process check anything? Overlapping employment dates are visible in ordinary reference checks, and are frequently skipped for remote hires.
Is your monitoring producing signal or noise? If this ran for six months under active monitoring, the monitoring was not doing what you bought it for.

What tracking can and cannot establish

Since we make this software, plainly: time tracking cannot see a second employer. It has no visibility into another company's systems and never will. What it establishes is what happened on the machine during tracked hours.

That makes it useful for two specific things. Faked-activity detection identifies simulated input with reasonable reliability, because synthetic events have signatures human input does not — and it routes findings to human review rather than issuing verdicts. Face verification confirms the person tracking time is the person you hired, which addresses the related but distinct problem of someone else doing the work.

Neither proves a second job. Both produce evidence worth a conversation. The wider signal set is covered in overemployment detection for remote teams.

The short version

Sort your evidence honestly and be sceptical of the weak bucket. Read the contract and take legal advice before the meeting. Do not escalate surveillance, cut access, or confront publicly. Present observations, not accusations, and listen. Decide on the basis of actual harm rather than the feeling of being deceived. Then look hard at what let it happen for months, because that part is yours to fix.