Can Employers Detect Mouse Jigglers? How Activity Fakers Show Up in Monitoring Data

What a Mouse Jiggler Actually Does

Every monitoring tool that reports "active time" or a green presence dot needs a signal that the person is there. The cheapest signal is input: mouse movement and keystrokes. A jiggler manufactures that signal.

There are three kinds. Software jigglers are programs that move the cursor a pixel every few seconds or send a harmless keystroke. USB hardware jigglers plug in and present themselves to the computer as a mouse, sending tiny movements. Mechanical jigglers are a small platform that physically moves a real mouse, so the computer sees ordinary input from its ordinary device. The third kind exists precisely because the first two are easy to spot.

Demand rose with remote work and with the overemployment trend, where one person holds two full-time remote jobs and needs the idle laptop to look busy. HR Grapevine reported in 2024 that monitoring of home workers was "back in the spotlight" on the strength of jiggler sales alone.

How Each Type Is Detected

Software jigglers

The easiest case. The program is a running process, visible to any endpoint management tool and often blocked outright by application allow-lists. The input it generates is also different at the operating-system level: Windows and macOS mark injected input as synthetic, and monitoring agents can read that flag. A cursor that moves exactly one pixel every thirty seconds, forever, is also not a pattern a human produces.

USB hardware jigglers

The device enumerates as a second pointing device. Device logs show two mice, one of which appeared on a Tuesday and has a vendor ID that matches a known jiggler manufacturer. Many IT teams block unknown USB human-interface devices by policy, which stops this kind before it starts. The movement itself is also uniform: identical intervals, identical distances, no acceleration curve.

Mechanical jigglers

The hardest to detect at the input layer, because the input is real. Detection moves to behaviour. The mouse moves, but the active window never changes, no application receives a click, no document is edited, and periodic screenshots show the same screen for hours. Activity without any corresponding work is the signature, and it is visible in any tool that records application time or screen state rather than motion alone.

What the Wells Fargo Case Showed

In May 2024 Wells Fargo dismissed more than a dozen employees in its wealth and investment management unit. The regulatory filings described them as "discharged after review of allegations involving simulation of keyboard activity creating the impression of active work". The bank did not say which tool found them, but the wording points at behaviour analysis rather than a device audit: activity that created an impression, not a USB stick.

Two things about the case matter for every other employer. First, it was not the jiggler that got people dismissed; it was the dishonesty the jiggler was used for, and most employment contracts and codes of conduct cover that already. Second, Wells Fargo had the data because it was measuring more than motion. A team that only counted mouse events would have seen a dozen productive employees.

In the UK, employment lawyers noted after the case that dismissal for using a jiggler would normally be treated as misconduct under a fair process, with the strength of the case depending on whether the monitoring was disclosed in the first place. The legal guide covers the disclosure requirements by country.

Why Activity Monitoring Invites Jigglers

A jiggler is a rational response to being measured by the wrong thing. If the dashboard rewards a moving cursor, people will move the cursor. The same logic produces task masking, where employees perform busyness for the metric, and it is why monitoring programs built on activity scores so often report high activity and flat output.

The research on this is consistent. Monitored employees who believe the measure is unfair are more likely to take unapproved breaks, work slowly on purpose and game the system, according to the Harvard Business Review's summary of monitoring studies. The jiggler is the physical form of that reaction.

The fix is upstream of detection. Measure time in work applications, output delivered, and attendance against schedule, and the jiggler fakes nothing that matters. The task masking guide and the idle time guide explain how to read activity data without rewarding motion.

Jigglers vs Legitimate Idle Time: Avoiding False Positives

The behavioural signature of a mechanical jiggler, motion without work, also describes several legitimate situations, and a detection rule that ignores them will accuse the wrong people.

Reading a long document on screen produces almost no input for twenty minutes and a screenshot that barely changes. A video call in a separate app shows a static foreground window and sporadic input. A phone call with a customer shows nothing at all. Thinking, sketching on paper and whiteboard sessions all look identical to a jiggler from the input layer. Any of these can run for an hour in a normal working day.

The differences are in the detail. Reading moves the scroll position and changes the page title every few minutes; a jiggler does not. A video call shows the meeting application in the foreground with its own activity, and the calendar has the meeting. A phone call has no input at all rather than metronomic input, which is the opposite signature. And none of these last the whole day: the pattern that caught the Wells Fargo employees was uniform input across entire shifts with no corresponding work anywhere in the record.

The rule that follows: never act on an input pattern alone. Look for the absence of work across the whole record for the period, and even then treat it as a question for the employee rather than a conclusion.

A Worked Example: What the Data Looked Like

A support operation of ninety agents noticed that one agent's active time had risen to 98 percent of scheduled hours, the highest on the team, while their ticket count had fallen by a third over the same month. Nobody had looked at the two numbers together until the monthly review put them side by side.

The activity log showed mouse events at four-second intervals from 9am to 5:30pm with no gaps for lunch, no application changes for stretches of up to three hours, and scheduled screenshots that were identical for most of the afternoon. The ticketing system showed work in the mornings only. The device log showed a second pointing device that had appeared five weeks earlier. The pattern was consistent with a USB jiggler covering afternoons away from the desk, and the agent confirmed it when shown the comparison.

Two things made the case clean. The organisation measured application time and output, so the gap was visible without any special jiggler detection, and the policy already said working time was assessed on work rather than input. The outcome was a written warning and repayment of the overclaimed hours rather than dismissal, because the agent's mornings were genuinely productive and the organisation's own idle-time alert, which fired after ten minutes without input, had been part of what the agent was avoiding. The alert threshold was changed the same week.

What to Do If You Find One

Finding a jiggler is evidence of a gap between what someone reported and what they did. It is not, on its own, evidence of how big the gap is or why.

Start with the data, not the device. Compare recorded hours with application time and delivered work for the period. If the person's output is fine and the jiggler was keeping a status light green during focused work in another tool, the finding is trivial and the policy is the problem. If hours were claimed for time with no application activity and no output, you have a time-reporting issue, and the time theft guide explains where the legal line sits.

Then follow the process you would follow for any misconduct allegation: present the evidence, ask for an explanation, apply the policy consistently. The investigation steps are the same ones used for falsified timesheets. Dismissing someone for a device without establishing what it was used for is how a strong case becomes an unfair-dismissal claim.

Finally, ask what the person was avoiding. A jiggler used to escape an idle-time alert that fires during reading or thinking is telling you the alert threshold is wrong. A jiggler used to cover a second job is a different conversation, covered in the moonlighting guide.

Policy Wording That Covers It

Most monitoring policies do not mention jigglers, which leaves managers improvising. Two sentences close the gap.

The first states the principle: "Employees must not use any device, software or method to simulate activity or misrepresent working time." The second states the measure: "Working time is assessed on application use, output and attendance, not on input activity alone." The second sentence matters more than the first. It tells people what is actually measured, which removes the incentive, and it protects the organisation from the complaint that it dismissed someone over a cursor.

The policy template has a section for acceptable use where both sentences fit.

How E-Monitor Handles It

E-Monitor does not report a productivity score built on mouse events, so there is no number for a jiggler to inflate. It records time in each application and website during work hours, attendance against schedule, and optional screenshots on a schedule the policy sets. A jiggler running on an otherwise idle machine shows up as hours with no application changes and identical screenshots, which is visible on the same dashboard the employee can see.

That transparency is the point. When the measure is time in real work, employees stop buying devices to fake it, and the activity logs become a record of work rather than a game.

Related reading: Pay Transparency and Productivity Data.

Frequently Asked Questions