You’re paying for hours worked. But how do you know the hours logged are real?
Timesheet fraud with remote workers isn’t new problem, but the methods have gotten more sophisticated.
Hardware mouse jigglers, auto-clickers, virtual desktops, and now AI-generated ghost work mean that surface-level time tracking alone no longer tells the full story.
This guide covers the specific fraud methods to watch for in 2026, how to investigate without crossing privacy lines, and how to resolve disputes fairly when you find something wrong.
Understanding the Contractor Relationship
Most Filipino virtual assistants work as independent contractors, not employees.
The relationship is governed by your service contract and general principles of civil or commercial law, not the Philippine Labor Code’s employment protections.
Disputes are resolved through contractual remedies.
That said, the Cybercrime Prevention Act (RA 10175) still applies.
A contractor who falsifies digital timesheets or manipulates tracking data can be held liable under Philippine law even if you’re overseas.
Document everything and your paper trail matters if it comes to that.
Common Timesheet Fraud Types in 2026
Hour padding is the most straightforward. A remote worker adds time beyond what they actually worked. In hourly arrangements, this directly inflates costs with no corresponding output.
Account sharing means multiple people work under one contractor’s login — either to handle overflow or split income. This makes accountability impossible and violates most service agreements.
Ghost work tasks involve claiming to have completed work that never happened. Unlike simple padding, this fabricates entire deliverables. The hours look real. The output doesn’t exist.
Technical activity simulation is where fraud has evolved. Mouse jigglers, auto-clickers, and scripted keyboard activity are designed specifically to fool time tracking software into registering active work time while the contractor is doing something else entirely.
AI-generated ghost work is the newest category — and the fastest growing. See the dedicated section below.
Detecting Technical Fraud: Mouse Jigglers, Auto-Clickers, and Virtual Desktops
Hardware and software tools designed to fake computer activity are widely available and inexpensive. Understanding what they produce helps you identify them.
Mouse jigglers
Physical USB devices or software generate constant low-level cursor movement. In time tracking tools, this registers as continuous “active” time. The tell is in the pattern.
Jiggler activity produces unnaturally consistent movement with no variation in speed, direction, or rhythm.
Auto-clickers and keyboard simulators
Generates fake keystrokes and clicks on a schedule. Again, the pattern is the signal. Genuine work produces bursts of activity followed by reading pauses.
Virtual desktop environments
Allows a contractor to run a monitored work session in a separate window while using their computer normally in the background.
Screenshot-based tracking tools capture the monitored window, not what’s actually happening on the machine.
For a detailed technical breakdown of detection methods, see our guide on how to spot mouse jigglers.
The Rise of AI Fraud: Spotting LLM-Generated Ghost Work
This is the fraud category most employer guides haven’t caught up to yet.
In 2026, the barrier to producing plausible-looking work output is extremely low.
A contractor can use any large language model to generate reports, research summaries, content drafts, data analysis narratives, and responses that appear to represent hours of effort.
They log the time. They submit the output. Neither looks suspicious on the surface.
What AI-generated ghost work looks like:
Generic structure with no specifics from your actual context. Real work on your accounts, projects, or clients contains details that can only come from doing the work.
AI output tends to be plausible but empty on specifics.
Suspiciously consistent formatting and tone across deliverables. Real workers have stylistic variation. AI output at volume has a uniformity that becomes recognizable.
A 6-hour research report that contains no information specific to your market, your competitors, or your actual brief is a signal.
What You can do: Cross-reference deliverables against the specific inputs and context only the contractor would have access to.
Ask follow-up questions about the work. A contractor who actually did the research can answer questions about it. One who submitted AI output often cannot.
Legal Boundaries: RA 10173 and Monitoring “Sensitive” Data
RA 10173 — the Data Privacy Act of 2012 — applies to your monitoring practices even as a foreign employer.
The National Privacy Commission’s proportionality principle governs what you can collect: monitoring must be necessary and not excessive relative to the business purpose.
Practically, this means:
- Time tracking and activity logging on company systems is permitted with proper disclosure
- Screenshot monitoring is permitted at reasonable intervals with contractor consent and disclosed purpose
- Continuous screen recording or keystroke logging requires strong justification and explicit contractual consent
- All monitoring methods must be disclosed in your service agreement before work begins
For a full breakdown of what’s permissible and what crosses the line, see our guide on monitoring Filipino contractors legally.
How to Handle Timesheet Disputes with Filipino Contractors
When you identify potential fraud, your remedies come from your service contract — not labor law. Here’s the process.
Review the contract first. Check your service agreement for clauses on time tracking, payment disputes, and termination. This determines your rights before you take any action.
Notify in writing. Send a clear, professional message detailing the specific discrepancies found, the contract provisions that apply, and a reasonable response window — typically 3–5 business days.
Suspend payment for disputed hours. Hold off on payment for questionable entries while the investigation is active. Your contract should explicitly permit this. Don’t pay amounts that may later be confirmed as fraudulent.
Gather and document evidence. Collect time tracking logs, project records, deliverables with timestamps, and communication history. This is your paper trail.
Take action based on findings. Confirmed fraud or serious discrepancies warrant one or more of: termination for cause, withholding payment for fraudulent hours, requesting repayment of overpaid amounts, or pursuing legal remedies if the amount warrants it.
How to Set Up Time Tracking Without Invading Privacy
The goal is a system that catches real problems without treating honest workers like suspects.
Use verified time tracking tools. Authentication-based platforms prevent account sharing and buddy logging while keeping monitoring minimal and purpose-driven.
Implement tamper-evident logs. Your system should automatically record who made changes, when edits occurred, and what was modified.
Cross-check time data against outputs. Match logged hours with actual deliverables, project management records, and task completion. This is the most reliable fraud signal available — and it works for AI ghost work too.
Automate anomaly alerts. Flag statistical outliers: sudden overtime spikes, off-hours logins, activity patterns that don’t match task type.
Disclose everything in your service agreement. What is tracked, how it’s used, and what happens if discrepancies are found. Transparency discourages fraud and protects you legally.
The more sustainable long-term answer is moving toward output-based management rather than pure hour tracking. See our guide on output-based management vs hours for how to structure this.
Cross-Checking Timesheets Against Project Management Tools
Set up monthly reviews comparing logged hours against task completion rates, deliverable submissions, and project milestones. Look for statistical outliers by contractor and by project type.
If most contractors on similar work average 40 hours weekly but one consistently logs 70, that warrants a closer look and a structured review.
Cross-reference time entries with communication records. Slack messages, email timestamps, and task comments all provide independent validation that a contractor was actually working during logged hours.
Setting Clear Expectations From Day One
Clear onboarding prevents most timesheet issues before they start.
Walk new contractors through your time tracking system.
Show them how to log correctly, how to handle corrections, and how to document unusual situations.
Explain why accuracy matters — not just for your budget, but for their own protection when invoices are reviewed.
Make it clear that you review time records regularly and have systems to detect inconsistencies.
Transparency about this discourages fraud attempts from people who were considering it, and reassures honest workers that the system is fair.
FAQ
What is the most common way VAs commit timesheet fraud?
Time padding remains the most common form. In 2026, the most technically sophisticated version involves hardware mouse jigglers: small USB devices that generate constant cursor movement to simulate activity in time tracking software.
Is it legal to terminate a Filipino VA for timesheet fraud?
For independent contractors, termination rights come from your service agreement, not the Philippine Labor Code. A well-drafted contract with a clause permitting termination for cause, including falsification of time records, gives you a clear legal basis. If your contractor is classified as an employee rather than a contractor, Article 282 of the Philippine Labor Code covers termination for serious misconduct, which includes falsification of work records. Either way, document your evidence before taking action.
How can I prevent time theft without micromanaging?
Shift the primary measurement from hours logged to outcomes delivered. Set specific, measurable KPIs for each role deliverables per week, quality thresholds, deadline adherence rates. And build in regular deliverable reviews that make it impossible to sustain ghost work over time without it becoming obvious.
Can a VA hide that they’re using a mouse jiggler?
It’s difficult to hide completely if you know what to look for. Jiggler activity produces a signature pattern: unnaturally consistent activity percentages (often 95%+), cursor movement with no correlated output or window change in screenshots, and activity that continues at the same rate regardless of task type.