Time theft is rarely proved by a supervisor’s suspicion or a manager saying an employee “always seems gone.” To understand how to prove time theft, an employer needs a clear timeline, reliable records, and evidence collected in a lawful, repeatable manner. The goal is not to catch someone in a gotcha moment. It is to establish what happened, when it happened, how often it happened, and whether the employee was paid for time not worked.
For North Carolina employers, the stakes can be significant. Time theft can quietly drain payroll, disrupt operations, damage morale, and create legal exposure if an investigation is handled carelessly. A defensible investigation protects the business while giving the employee a fair opportunity to respond.
What Counts as Time Theft?
Time theft occurs when an employee intentionally receives pay for time they did not work or misrepresents working time. It can take obvious forms, such as clocking in and leaving the premises, but the more difficult cases often involve patterns hidden inside ordinary workdays.
Common examples include an employee asking a coworker to clock them in or out, reporting hours while running personal errands, extending breaks beyond policy, or altering time records after the fact. Remote and hybrid work can introduce other forms, including reporting a full day while repeatedly being unavailable, falsely documenting work activity, or using software designed to imitate keyboard or mouse activity.
Not every performance concern is time theft. An employee can be slow, distracted, or unproductive without falsifying time. That distinction matters. A rushed accusation based on output alone can damage a legitimate employment relationship and create a weak foundation for discipline. The strongest cases focus on intentional misrepresentation and verifiable facts.
Start With the Records You Already Control
The first move is preservation, not confrontation. Once concerns arise, preserve relevant records before routine deletion, automatic overwrites, or informal changes erase useful information. Avoid alerting the employee before you know the scope of the issue, especially if the matter involves shared credentials, manipulated records, or company devices.
Review the timekeeping system first. Pull original clock-in and clock-out records, edits, approval histories, schedule data, overtime entries, and payroll reports for the period in question. A single discrepancy may be an honest mistake. Repeated changes made after a manager’s review, identical patterns around certain shifts, or corrections that consistently benefit one employee deserve closer scrutiny.
Then compare those records against operational data. Depending on the role and workplace, useful sources may include badge-access logs, visitor records, vehicle GPS or telematics, dispatch records, point-of-sale activity, job tickets, customer appointments, call logs, system login records, and security video. The question is simple: does the employee’s claimed time align with independent records of where they were and what they were doing?
A timecard is an assertion. Corroborating records turn that assertion into evidence.
Build a Timeline That Can Withstand Scrutiny
The most effective way to prove time theft is to construct a timeline for each suspected event. Do not rely on a pile of screenshots or an impression that “the data looks wrong.” Organize evidence chronologically so a manager, attorney, insurer, or court can see the full sequence without guessing.
For example, a timeline might show that an employee clocked in at 8:00 a.m., badge-access records show no entry into the building until 9:06 a.m., a company vehicle remained at the employee’s residence during that period, and no work-system activity occurred until after 9:10 a.m. One source can be challenged. Several independent sources telling the same story are far more persuasive.
Document the date, claimed hours, actual activity, supporting source, person who collected the information, and any explanation offered by the employee. Keep original files intact. If you export records or take screenshots, record when and how that copy was created. This discipline is especially important when the evidence may support termination, restitution, civil action, or criminal referral.
Use Digital Evidence Carefully
Digital evidence can expose time theft that manual records miss, but it must be collected within the boundaries of company policy, employee notice, contracts, and applicable law. A company-issued laptop, phone, fleet vehicle, or managed work account may contain valuable evidence. That does not mean an employer should search every device or account without a defined purpose and proper authority.
Computer and mobile device evidence may reveal login times, application activity, file creation and modification records, location artifacts, communications, deleted data, or attempts to alter records. These artifacts can be powerful, but they are easy to misinterpret without forensic experience. A login event may show that a device connected to a network. It does not always prove the employee was personally working at that exact moment.
Forensic collection also protects the integrity of the evidence. Opening files, scrolling through a phone, or allowing an internal employee to “look around” can alter metadata and compromise the ability to explain what was found. When the matter is serious, preserve the device and use a qualified digital forensic examiner who can create a verified forensic image and document the chain of custody.
Surveillance Can Confirm the Facts
Video surveillance is often useful when time theft involves attendance, extended breaks, unauthorized departures, or false field-service reporting. Existing security footage should be preserved promptly because many systems overwrite recordings within days or weeks. Review the camera’s date and time settings before relying on the footage. An incorrect system clock can create unnecessary doubt.
When surveillance is needed beyond existing cameras, it should be targeted and lawful. The investigation should focus on work-related conduct, public locations, or areas where the employer has a legitimate right to observe. Do not use hidden cameras in places where employees have a reasonable expectation of privacy, such as restrooms or changing areas. Do not record private conversations without confirming that the method is lawful.
A professional investigator can help determine whether surveillance is appropriate and whether it will add meaningful proof. In some cases, records already establish the issue. In others, discreet observation is what confirms that a field employee billed a full shift while spending hours on personal activities.
Interview Only After You Know the Facts
Employee interviews should come after the evidence review, not before it. If you confront someone with a vague concern, you may unintentionally reveal the limits of your knowledge and give them time to coordinate stories, delete data, or change behavior.
Prepare a short list of fact-based questions. Ask the employee to explain specific dates, claimed work hours, missing activity, travel, or timecard edits. Keep the interview professional. Do not accuse, threaten, or make promises you cannot keep. Have a witness present when appropriate, and document the employee’s answers as accurately as possible.
An explanation may resolve the issue. A badge reader could have failed, a manager may have approved an unusual schedule, or a worker may have been performing duties away from a tracked location. If the explanation conflicts with objective evidence, document that conflict. Truthful, consistent explanations tend to fit the records. Fabricated explanations often shift as the evidence becomes more specific.
Avoid the Mistakes That Weaken a Case
A valid concern can become a difficult case if the employer cuts corners. Do not alter time records to “correct” them before preserving the original. Do not rely solely on rumors from coworkers. Do not access personal accounts, install monitoring tools without authorization, or use unauthorized tracking methods. And do not treat every missing keystroke, delayed email response, or low-production day as proof of fraud.
Consistency matters as well. Apply policies evenly. If one employee is investigated for long breaks while others are routinely allowed the same practice, the issue may be poor policy enforcement rather than intentional time theft. Review whether employees received clear notice of timekeeping rules, break expectations, monitoring practices, and consequences for falsification.
When to Bring in an Outside Investigator
Outside help is appropriate when losses are recurring, a supervisor may be involved, digital evidence could be altered, or the case may lead to litigation or law enforcement involvement. It is also valuable when the employer needs an independent investigation rather than an internal review that could be questioned for bias.
Advanced Technology Investigations, LLC combines field investigation with digital forensic evidence preservation to help businesses establish the facts without contaminating critical proof. The right investigative approach can identify the scope of the loss, preserve relevant electronic evidence, document surveillance findings, and produce a clear report for leadership or counsel.
Time theft should be addressed decisively, but never recklessly. Preserve the records, verify the facts through independent sources, and act only when the evidence supports the decision. That approach protects payroll, protects legitimate employees, and puts your business in a stronger position when the truth must be proven.
