Can employers detect a mouse jiggler? Often. That is the wrong question.

Can employers detect mouse jigglers? Often, yes. A software jiggler is a running program that IT tools can list. A plug-in jiggler registers with the computer as a new input device. And almost every jiggler produces an odd-looking day: hours of movement with no typing, no switching between apps and nothing delivered at the end of it.

Detection is the easy half of this subject. The harder half is what a jiggler says about the metric it is fooling, and that is the half worth fixing, whichever side of the screen you sit on.

How does mouse jiggler detection work?

Not every employer looks, and plenty never will. But companies that do detect mouse movers rely on three kinds of signal, and none of them is exotic.

The software is visible

A software jiggler is a program. On a company laptop, programs are not private. Device management and endpoint security tools keep an inventory of what is installed and what is running, and IT can read that inventory whenever it has a reason to. A utility whose only purpose is to generate fake input is not hard to recognise in a list.

The hardware introduces itself

A plug-in jiggler lives outside the laptop, but it still has to introduce itself. Any USB mouse or keyboard tells the operating system what kind of device it is the moment it is connected. That is simply how plug and play works. Managed laptops can log device connections, so a second “mouse” that appeared the week remote work started and never left becomes a line in a report.

The pattern looks wrong

This is the signal that catches people, because it does not depend on any particular tool. Real work leaves a messy trace: typing in bursts, jumping between applications, files saved, messages sent, pauses that line up with meetings and lunch. Faked input leaves a tidy one: usually movement at regular intervals, hour after hour, with nothing else happening.

The movement is not really the tell. The absence of everything else is, and the one thing no gadget can supply is the work itself.

And the oldest detector of all needs no software. A manager who sees a status that stayed green all afternoon, then receives work that plainly took an hour, has spotted the gap without running a single report.

Can Microsoft Teams detect a mouse jiggler?

This is the question a lot of people are really asking, because for many of them the Teams dot is the thing being fooled.

Microsoft documents how presence in Teams works. It is driven by activity on the device, by what the Teams app is doing, and by your calendar. On a computer, you go Away automatically after a few minutes of inactivity or when the machine locks. Nothing in that documentation describes Teams checking whether the activity is genuine. It reads activity. It does not audit it.

That is poor comfort. Teams is a chat app, and it is rarely the only software on a work laptop. The management and security tools on the same machine report to IT, not to your contact list. And a green dot that never matches any output is exactly the pattern problem above, noticed by a person rather than a program.

Why do people use mouse jigglers?

Some people use them to be paid for time they did not work. That happens, and nothing here pretends otherwise. But it is not the whole picture, and managers who assume it is will fix the wrong thing.

For many people, the thing being fooled is not a monitoring tool. It is a status light. The dot turns yellow after a few minutes without input, and a great deal of real work involves no input: reading a long document, thinking through a problem, sketching on paper, a client call taken on a phone. To the dot, all of it looks like absence. Remote workers who suspect they are judged on how often they look available buy a gadget to stop the dot misrepresenting them. The irony is that the gadget makes it misrepresent them in the other direction.

Others have a more mundane problem: a locked-down laptop that sleeps or locks halfway through a long download, render or presentation, with no permission to change the setting. That is a real annoyance with a boring, legitimate fix. Ask IT for an exception.

Either way, notice what the jiggler is a response to. It is a response to being measured on something that is cheap to fake and says almost nothing about the work.

Can you get fired for using a mouse jiggler?

Yes, and it has happened at a household-name employer. In 2024 Wells Fargo dismissed more than a dozen employees in its wealth and investment management unit. Disclosures filed with FINRA, the self-regulatory body for US broker-dealers, said they were “discharged after review of allegations involving simulation of keyboard activity creating impression of active work”. The story was reported by Bloomberg, and Banking Dive summarised the filings. CBS News noted that it was unclear whether the employees had used mouse movers, or whether they were working from home or the office.

Two details matter more than the headline.

The wording. The allegation is not “owned a jiggler”. It is “creating impression of active work”. What gets people dismissed is the misrepresentation, not the gadget. An employer who finds one may not feel any need to prove that a single hour was wasted. The device exists to make the record say something untrue, and for many employers that is enough.

Where the reason ended up. In a regulated industry, the reason for a dismissal can be reported to the regulator. That is how this case became public at all.

Outside regulated industries there may be no regulator involved, but the logic holds. Employment contracts and IT policies commonly cover unauthorised software and devices on company equipment, and disciplinary policies commonly treat dishonesty as serious misconduct. If it comes to that, you will be arguing about how bad it was, not whether it was allowed.

Is using a mouse jiggler time theft?

“Time theft” is an employer’s phrase, and whether it has a precise legal meaning depends on where you work, your contract and how you are paid. This is not legal advice. The practical picture is still fairly clear.

If you are paid by the hour, or you bill a client by the hour, and the jiggler makes idle time look like worked time, you are being paid for time you did not work. Call it what you like. Your employer or your client will very likely call it theft, and it is a hard point to argue.

If you are salaried and the work is getting done, the harm is different. Nobody paid for an empty hour. What they lost is the ability to trust the record, and many employers treat that as misconduct in its own right. The Wells Fargo wording is about the false impression, not about hours.

A plain test beats a legal one: could you tell your manager exactly what the device is for, in those words? If you could, tell them, and ask for the thing you actually need. If you could not, you already know the answer.

If it has already become a disciplinary matter, get proper advice from a union, an employment adviser or a lawyer where you work.

Why is “can they detect it” the wrong question?

Because the metric being fooled measures presence, not work, and a jiggler is just the cheapest proof of that.

A status light answers one question: has a cursor or a key moved on this machine in the last few minutes? Every time a manager reads that answer as information about output, they are managing a number that a USB stick can produce on its own.

Take a hypothetical team of two, and assume the dot flips to Away after a few minutes without input. One person keeps a jiggler plugged in and shows green nine hours a day. The other reads specifications on paper, takes client calls on a phone while walking, and shows Away for a couple of hours most afternoons. Judged by the dot, the first is the reliable one. Judged by what shipped, it could easily be the other way round, and the dot cannot tell you which.

That is why detection on its own is a dead end as a management strategy. You can catch the jigglers, then catch the next workaround, and you will still be measuring the wrong thing. Once a measure becomes a target, people optimise the measure. When the measure is presence, optimising it produces a jiggler.

What should managers measure instead?

Three things, none of which a moving cursor can satisfy.

Output against what was agreed

Agree each week what someone expects to deliver, then look at what was delivered. It is the only measure that answers “is the work getting done”. It requires judgement, and that is its strength: a manager who has to look at the work cannot be fooled by a USB stick.

Availability windows, not availability lights

If the real worry is “can I reach them when something breaks”, agree that directly: core hours, a reply time within them, and a norm for outside them. A promise someone made can be held to in a way a sensor cannot, and it frees everyone from performing presence for the rest of the day.

Time records the person owns and can see

If you need hours, for client billing, pricing or capacity, use a record sorted by project that the person can see, check and correct. The UK regulator’s guidance on monitoring workers tells employers to be clear about their purpose and “select the least intrusive means to achieve it”, and notes that expectations of privacy are significantly greater at home than in the workplace. That is a sensible bar in any country.

A counts-only record clears that bar far more easily than screenshots or keystroke logs. What time trackers actually collect sets out the difference tier by tier, and our page on time tracking without screenshots describes what we chose to capture and what we refused.

Side by side:

What you want to know	What the status light tells you	What to use instead
Is the work getting done?	A cursor moved recently	Agreed deliverables, reviewed weekly
Can I reach them when it matters?	Possibly, right now	Core hours and an agreed reply time
Where is the time going?	Nothing	Hours per project, in a record the person can see
Are they overloaded or drifting?	Nothing useful	A regular one-to-one, plus hours per project over several weeks

A working agreement you can copy and adapt:

Core hours are 10:00 to 15:00 in your own time zone. During core hours, reply to direct messages within an hour. Outside them, replies can wait for your next core block. Nobody will comment on the colour of your status. Each Monday, post what you expect to deliver this week. Each Friday, post what shipped and what slipped, with a line on why. Time is recorded per project so we can price work properly. You can see your own record, and nobody else sees it unless they have been given reporting access for a stated reason.

For the record, since this is our blog: Stunda counts keystrokes and clicks, never their content, and the person being tracked can see their own record. It does check whether input looks machine-made. A stretch of movement that never clicks or types, or input arriving at perfectly regular intervals, is marked for review rather than deleted, with the time kept in full and the judgement left to a person. That is the only version of detection we think holds up: a note on the record, not a verdict. A record people can see and correct is one they have less reason to fake.

What should you do if you use a mouse jiggler now?

Stop, and not only because of the odds of being caught. The device is solving the wrong problem, and every week it runs makes the honest conversation harder to start.

Work out which problem it was solving:

• The dot. If it keeps you green while you read, think or take calls away from the keyboard, the fix is an agreement about availability. The script below is a starting point.
• The lock screen. If your laptop sleeps during long jobs, ask IT for an approved setting. It is a routine request.
• An activity score. If your employer runs software that scores you, ask what the score is used for and who sees it. That is a reasonable question, and in the UK the regulator’s guidance says employers must make sure workers are aware of what monitoring collects.
• Time you were not working. Then the problem is not the metric, and a jiggler only postpones the conversation.

For the first case, something like this:

I have noticed that I spend more energy on my status light than it deserves, and I do not think it tells you much about my work either. Could we agree core hours when I will reply within the hour, and judge the rest on what I deliver each week? If there is something you are not seeing from me, I would rather hear it directly.

What to do next

If you manage people, find the number someone on your team would be tempted to fake, and replace it this week with an agreed output, an agreed availability window, or a record the person can see. If you are the one with the jiggler, unplug it and have the availability conversation instead.

Both conversations are uncomfortable for about ten minutes. The alternative is a system where everyone performs work for a sensor and nobody learns anything true.

If you want to see where your time goes without maintaining anything, and without anyone reading over your shoulder, Stunda records it in the background, counts activity without capturing content, and shows you your own record. Where input looks machine-made, it flags the block for a person to judge instead of deciding for them.