Overemployment detection: how to know if a remote employee is working two jobs

Overemployment — one person quietly holding two or more full-time remote jobs — is hard to spot from the outside. Deadlines slip a little, replies come slower, availability gets vague. But a hunch is not evidence, and confronting someone with nothing more than a hunch is unfair to them and uncomfortable for you.

SCREENish is employee time-tracking software with screenshots. It does not decide who is overemployed. It gives you an honest record of the hours you pay for — what was worked on, how engaged each session was, and which machine it came from — so you can either put a suspicion to rest or open a conversation with real facts in hand.

The signals that actually matter

A second job leaves patterns in tracked time. These are the ones SCREENish records for you.

Tracked hours with screenshots

While an employee tracks time, the desktop app captures screenshots at random moments within each 10-minute interval and stores them for 45 days. In Work Logs you pick a person and a date and read the whole day: click any screenshot to see keyboard and mouse activity, idle time and notes, and check which programs were active during that stretch. Ten hours billed to you should look like ten hours of your work — and now you can see whether they do.

Activity levels and idle patterns

Activity levels show engagement at a glance — active, partially active or idle — measured from whether the keyboard and mouse were in use, never from the content of what was typed. With idle reports enabled, an employee who stops responding to an inactivity prompt has that time recorded as idle: the affected screenshots get a dashed border and the day lists its total idle minutes at the top. Repeated long idle blocks inside supposedly focused hours are exactly the kind of pattern worth a closer look. The markers are explained in Screenshots: Deleted and Idle Markers in Work Logs.

Activity Review: catching faked input

Someone splitting attention between two employers may lean on a mouse jiggler or auto-clicker to keep a tracker looking busy. SCREENish flags stretches of tracked time that look machine-generated and queues them in Activity Review for a person to judge. Each card explains why it surfaced, and when there is a legitimate cause — a remote-desktop session, for example — the card says so plainly before you act. Nothing is rejected and nobody is penalised automatically: you read the evidence, open the screenshots, then confirm, dismiss as a false positive, or ask for more information.

Machine & System Info: which computers the time comes from

The Machine & System Info panel in Work Logs lists every computer an employee tracks time on with a recent version of the desktop app: operating system, monitors and their resolution, how many screens are captured, CPU, RAM and cameras, with a green dot when a machine is online. If someone says they work from one laptop and the panel tells a different story, you will see it. The panel is visible to managers only, and what is collected is disclosed to employees in the privacy policy.

Face verification, with consent

The harder question is identity: is the person tracking time the person you hired, or has the work been quietly passed to someone else? SCREENish offers Face Recognition, currently in beta, for exactly this. It is strictly consent-based — the employee grants consent per employer and can withdraw it at any time. Once they submit a profile photo and you approve it, the app verifies it is really them during work sessions, and the match rate per hour appears in Work Logs. Face Recognition: Setting Up Your Photo shows how the feature looks from the employee's side.

Verification, not surveillance

Tools like these only work if your team can trust them, so SCREENish is built to verify rather than to accuse:

• Faked-input flags are never automatic verdicts — a person reviews every one, and likely benign explanations are surfaced before you decide.
• Employees may delete their own private screenshots; the work log keeps a marker and a count, and deleting is allowed by design.
• Idle markers and camera notices are context, not accusations — people step away from their desks, and cameras fail far more often than people do.
• Consent for face verification belongs to the employee. Their answer is recorded with a date, and if they decline, the feature stays off.

Handled this way, the same records that expose a problem also protect the people doing honest work: their approved hours, normal activity levels and verified sessions are on file, exactly as they happened. Most overemployment conversations end with an explanation, not a firing — and either way, you are talking about facts instead of feelings.

Frequently asked questions

Can time-tracking software detect overemployment?

No software can prove that someone holds a second job. What SCREENish gives you is the record that makes the pattern visible: tracked hours with screenshots stored for 45 days, activity and idle levels for each interval, flags on input that looks machine-generated, the computers each person tracks from, and optional consent-based face checks. A pattern in that record is grounds for a conversation, not a verdict.

How can I tell if a remote employee is using a mouse jiggler?

SCREENish flags stretches of tracked time that look like the work of an auto-clicker or mouse jiggler and queues them in Activity Review for a human to examine. Each flag explains why it surfaced, and legitimate causes such as remote-desktop sessions are called out as likely benign. No time is rejected and nobody is penalised automatically.

Can I see which computers an employee tracks time from?

Yes. The Machine & System Info panel in Work Logs lists every machine running a recent version of the desktop app, with its operating system, monitors and resolution, number of captured screens, CPU, RAM and cameras, and shows a green dot next to any machine that is online now. The panel is visible to managers only.

Do employees have to agree to face verification?

Yes. Face Recognition is optional, currently in beta, and requires the employee's consent for each employer before it can be enabled. They can withdraw consent at any time, their answer is recorded with a date, and the photo is used only to verify them during work sessions — it is never shared with other employers.

Will monitoring like this treat honest employees unfairly?

The design points the other way. Faked-input flags are reviewed by a person, benign explanations are surfaced before you act, idle and deleted-screenshot markers are explicitly not accusations, and employees may delete private screenshots. For honest employees the record is protective: it shows their hours, activity and verified sessions exactly as they happened.