How to Find Out if an Employee Is Moonlighting – Signs & Risks

Introduction

Moonlighting is more financially compelling than most employers realise. Knowledge workers in the US who freelance alongside a full-time job earned a median $40,000 in supplemental income in 2024 and 36% of full-time knowledge workers are actively considering freelancing on the side, which is precisely what moonlighting looks like in the modern workforce (Upwork Research Institute, 2025).

The financial incentive exists everywhere remote work does and with 52% of remote-capable employees now in hybrid arrangements and 27% fully remote (Gallup, 2025), that means most knowledge organisations are already exposed. The risks are real: a moonlighting employee can drain productivity, expose confidential data, and work for a direct competitor, all from the same company-issued laptop. 

This guide covers how to recognize the signs of moonlighting, how to investigate it using endpoint monitoring data, and how to build a policy that protects your organization without creating a surveillance culture. The shift to remote working, rising prices, the change in the job market, the era of the creator economy, gig platform economy, and "overemployment" make modern moonlighting quite different from what we knew before. 

The right response to the problem of employee moonlighting is not surveillance but developing strategies that would help us control the process. This article will provide information about how to recognize moonlighting, signs of moonlighting, various ways to find out about moonlighting, whether it is legal or not, and ways to prevent moonlighting in the remote team without invading anyone's privacy.

What Is Employee Moonlighting?

Moonlighting means working for oneself or for another company while still being a permanent employee of the organization. An employee may moonlight in one or more of the following ways:

• Fulltime employment and freelance work outside regular working hours
• Working part-time for another company
• Performing paid freelance work for other parties during working hours
• Performing two full time jobs remotely in parallel
• Employees of sales, IT, finance, and HR departments providing consulting for other companies
• Working on one's own business project during work hours and using company equipment, network or contacts to get more clients

In academic literature, moonlighting is considered a trend caused by social and economic processes in society. Those processes that cause employees to perform additional work include:

• Rising prices, inflation, increasing rents and mortgage payments, and taxes
• Ability to do moonlighting owing to remote work
• Earning money through gig economy platforms
• Learning new skills
• Dislike of the current job or workplace

The Difference Between Moonlighting, Dual Employment, and Overemployment 

Each term describes a different type of employment but are often confused. Moonlighting is an activity when a person works additionally outside their main job. Dual employment means that a person works for two organizations full time at the same time. Dual employment is rather common in some sectors of industry (day job: mechanic, night job: security guard) and may even be regulated in some places. Overemployment is doing two or more jobs in remote mode at the same time.

Different Types of Moonlighting

Moonlighting refers to a continuum rather than to a particular kind of employee behavior. There are individuals who occasionally take up external activities which do not have anything in common with their main occupation. On the other hand, a number of workers create a parallel career which competes with the existing primary occupation in terms of time, attention, availability, and sometimes even the employer's data protection policies.

Depending upon the type of employment chosen, there are different types of moonlighting:

1. Blue Moonlighting

Occasional, infrequent outside work unrelated to the employee's primary role for instance a weekend logo project, a one off tax consultation for a friend. Blue moonlighting rarely causes workplace problems on its own. A graphic designer who freelances occasionally on weekends is unlikely to affect performance or create a conflict of interest. Employers typically don't penalise this unless the frequency increases or it begins affecting output.

2. Quarter Moonlighting

Several hours per week of outside work tutoring, freelancing, contract projects - alongside satisfactory primary job performance. 

As far as observable signs of such moonlighting, one could observe employees performing their main job satisfactorily: they are meeting their deadlines, attending necessary meetings, submitting required paperwork, and so forth. Still, certain hints of moonlighting will become apparent to the management. 

For instance, it may turn out that employees' response times became somewhat lower, that they login and logout of work more frequently than earlier, that they began transferring unusual files, and so forth.

3. Half Moonlighting

Significant time split across two employers simultaneously, common in hybrid roles where calendar management allows parallel workloads. 

Such a phenomenon is more common among those employees who work remotely or in a hybrid format. They may be participating in company meetings while at the same time responding to messages from their other client, opening multiple chats within one computer, and using the same machine as a tool for communicating with two or more employers.

4. Full Moonlighting

Two full-time jobs held concurrently, often with automated presence simulation - the highest-risk category for data exposure and conflict of interest. 

This type of moonlighting is particularly problematic since it entails many risks, including business, legal, productivity, and cybersecurity ones. Thus, the employee in question may become unavailable to employers since he or she will have to dedicate a significant amount of time to another job.

Some employees may even try to fake their presence via automation. In certain cases, this can result in sharing sensitive data and working for competitors in a manner that can harm the company in question. Such a situation becomes particularly problematic in cases when employees work for a regulated industry and have access to a range of confidential data.

Is Employee Moonlighting Legal?

The practice of moonlighting may be either legal or prohibited according to the policy adopted in the company or as defined by the government. In the United States, employee moonlighting may be allowed or prohibited depending on individual agreements signed between employers and employees. 

In the US, as of March 2026, 20 states have adopted laws regulating employee privacy and prohibiting employers from conducting surveillance in the office. Moonlighting of federal agency employees is highly regulated in accordance with ethics standards, which stipulate approval of employment and prohibitions on conflict of interests.

US Legal and Labor Environment rules and regulations regarding Dual Employment:

At-Will Employment: In most states in the USA, an employee is not prohibited by law from working in several places, nevertheless, the employer is absolutely free to obligate the employee to dedicate himself/herself mainly to working on behalf of the employer.

National Labor Relations Board (NLRB): NLRB analyzes the overly broad clause about “full-time employment.” Blanket clauses restricting an employee’s freedom to work part-time elsewhere can be declared unconstitutional under federal labor laws.

State Legislation: Some states (e.g., California, Colorado) passed off-duty conduct legislation making dismissal of an employee who works part-time elsewhere illegal unless the second job interferes with the employer’s business.

To conclude, moonlighting cannot be categorically classified as illegal. But certain types of moonlighting might lead to severe consequences, especially in cases when moonlighting involves violation of contractual obligation, conflict of interests, disclosure of corporate data or information, or negative impact on employee's performance and productivity. Therefore, moonlighting itself cannot be forbidden but it needs to be addressed and managed to prevent problems.

Why Is Moonlighting Hard to Manage in 2026?

Employee moonlighting is a fairly old notion but it has changed significantly. The factors that complicate the management of moonlighting in remote employees in 2026 include the following:

• Approximately 52% of US employees with remote-capable jobs work in hybrid arrangements, and 27% are fully remote.  
• Increased flexibility of schedule for remote workers, making moonlighting hard to detect
• Increased opportunities provided by gig economy platforms
• Inflation and associated economic hardships driving people to earn more
• Improved productivity due to artificial intelligence technology, allowing people to spend fewer hours to perform more tasks
• Issues that appear only as low quality deliverables in remote team

The employer must deal with the following aspects of moonlighting:

• Performance issues that moonlighting leads to
• Information security issue caused by the possibility to disclose company information
• Issue of policy and regulations to regulate outside activities

Indicators of Employee Moonlighting

There is no single sign of moonlighting, but there are some behaviors to look out for:

• Decreasing performance and quality of deliverables for unclear reasons: formerly productive people become unreliable and unable to submit the work on time, showing online presence but submitting low quality work because of mistakes or lack of effort
• Inconsistent schedule with unpredictable availability of employee: he/she skips work hours, misses calls and meetings, responds late, always has appointments in his/her calendar
• Passive participation in meetings: the employee appears on meetings but is not involved much, not responding actively to questions, speaking rarely with camera turned off
• Online during working hours but idle during breaks: this behavior becomes increasingly suspicious in 2026 thanks to the availability of deception devices and software, mouse clicks and internet activity are high, but no work is done during working hours
• Odd working schedule with long or short working sessions: the employee works at unexpected times, like early in the morning or late at night, or works in bursts of activity, this is not necessarily bad, but should not impact productivity and cooperation
• Using the company's hardware to perform moonlighting activities: this red flag means that a person uses company equipment for freelance or consultancy, such people can send emails to customers, upload and download files etc.
• Large number of downloads and file transfers: large amounts of data transferred via USB drives or any other devices, especially related to financial and customer data
• Not discussing the issue: the employee refuses talking about moonlighting and denies doing anything wrong

How to Detect Employee Moonlighting? 

Here are six steps to follow when trying to uncover employee moonlighting -

Step 1. Clarify expectations from the employee

First, check whether your organization has a moonlighting policy, role responsibilities, realistic deadlines, expected availability, scheduled meeting times, and security protocols. 

Step 2. Compare the current performance with past statistics

Check whether the performance has dropped lately because employees may moonlight. You may look for such patterns as:

• Delays in deadline completion
• Poor quality work
• Long response time
• Small number of completed tasks
• Idleness
• Unfinished tasks
• More rework
• Reduced contribution to collaboration
• Unavailability during core working hours

Don’t judge an employee based on a week’s performance, instead, consider and observe if similar patterns reoccur during a month or even a few months.

Step 3. Evaluate the employee's declaration

Does your company have a moonlighting policy? If yes, then it may imply that an employee needs to declare his or her outside work. 

Step 4. Review device and app usage

Employee monitoring tools may help you understand what your employee does and how much time he or she spends on various tasks. For instance, CurrentWare gives IT teams three monitoring layers relevant to moonlighting investigations:

• BrowseReporter for activity & web monitoring: Filter web activity logs for known freelance platforms (Upwork, Fiverr, Toptal, Freelancer.com) and personal cloud storage (Dropbox personal, Google Drive personal, WeTransfer). Cross-reference active app time against scheduled work hours to identify productivity gaps. 
• BrowseReporter (mouse jiggler alert detection): Employees working two jobs often use mouse jiggler devices or software to fake an active status. BrowseReporter's Mouse Jiggler Alerts detect this pattern automatically, flagging sessions where cursor movement is present but no genuine application activity follows. 
• AccessPatrol: USB and peripheral control: AccessPatrol logs all USB write events with timestamps, file names, and device identifiers. In moonlighting investigations, spike activity in USB writes, especially involving client files, templates, or database exports is a primary data exfiltration signal. 
• BrowseControl (Web and application usage control): BrowseControl allows you to block suspicious websites and applications on official devices. In case an employee is using an official laptop/system the entire web activity can be used as evidence if needed in accordance with the company policies.

Step 5. Identify conflict-of-interest indicators

The worst thing about moonlighting is when an employee works with a competitor. The following activities are concerning:

• Working for a direct competition
• Providing consultancy for a competing company
• Building a similar product to your organization's product
• Consulting on issues similar to what your organization offers to customers
• Sourcing or selling to company clients
• Soliciting company employees or customers
• Using company hardware/software/templates/skills/credentials

This step definitely requires collaboration between HR, legal, and IT departments.

Step 6. Discuss the problem with the employee

Do not skip this step because talking with employees may provide you with more information about the root cause. Your discussion may go like this:

"We noticed that lately, you had been missing our core hours, and we could observe poor quality deliverables. We are not making any assumptions, we just want to figure out what prevents you from meeting expectations in your role."

The Business Risks Connected With Employee Moonlighting

The potential risk that employee moonlighting poses for your business depends on the kind of outside work. For instance, moonlighting can consist of a side photography gig or a software engineer's development of a competing product. Below are seven risks of moonlighting employees.

1. Reduced output: First, a major risk is productivity loss because employees need to manage two fulltime jobs at once.
2. Fatigue and burnout: Second, it is hard for people to manage two occupations simultaneously. As a result, an employee may experience burnout, exhaustion, or problems with sleep, which can negatively affect the performance.
3. Exposure to confidential data: The third aspect is a huge risk to organizations because executives care about confidentiality above all else. Access to company data and intellectual property can expose organizations to great risks because the data can leak even by accident.
4. Conflicts of interest: Fourth, when outside work affects an employee's core duties, this becomes a conflict of interest that needs to be addressed immediately because moonlighting can become a public issue.
5. Misuse of company resources: Employees should not use any company assets to conduct outside work.
6. Increased insider risk: This problem can come in addition to the previous one because people may start using company devices and confidential information to commit malicious actions against your organization.
7. Team morale and cultural problems: Last but not least, if one person tries to balance two jobs and pushes his or her workload on colleagues, it can ruin the atmosphere in the team and cause many issues in the future.

How to Prevent Employee Moonlighting in Remote Teams?

It's almost impossible to prevent all moonlighting cases. Nonetheless, below are some preventive measures.

1. Develop a Clear Policy

The main issue with moonlighting is vagueness, so you need to have a clear policy. It should cover such points as:

• Activities employees may and may not do for money
• What types of activities must be declared to the company
• How employees must use company resources and access when working outside
• What to expect from employees in terms of performance, security, and availability
• Potential consequences for moonlighting
• Approval and disclosure process

It's important to formulate everything clearly so that your employees can easily follow your policy.

2. Encourage Employees to Disclose

Though you may not want to hear negative things about your organization, you need to create a friendly atmosphere for discussion. Instead of accusing employees, encourage them to voluntarily disclose any side jobs they have taken up to assess any conflict-of-interest situations which require legal clearance (especially if you have mentioned this in their offer letter or in your employment policy).

3. Set Boundaries Around Core Working Hours

Though flexibility is essential in remote work, you need to establish core working hours to avoid any confusion.

4. Implement Transparent Workforce Monitoring

If you own the equipment, you have a right to monitor employee activity on these devices. It's important to implement monitoring with purpose limitation and reasonable notice. What can you learn about employees via workforce monitoring?

• Are they active in the time that corresponds to their responsibilities?
• Do they visit any risky websites?
• Do they transfer data to unauthorized places?
• Have employees' productivity trends changed?

5. Pay Attention to Data Movement and Usage

File transfer activities, downloading of files from the Internet, usage of cloud storages, USB drives, and access to sensitive folders reveals a lot about employee behaviour and intent.

6. Distinguish Harmless Side Activities from Moonlighting

A simple rule to live by is to prohibit everything and allow nothing. However, it's counter productive to ban all employee activities. In this context, it's useful to differentiate outside activities based on their harm or benefit to your organization. A moonlighting policy for remote employees can look like this:

• Allow (with notification) activities like tutoring, freelance projects (outside your company's market), and writing. Employees must notify you if they plan to do freelance work.
• Completely prohibit outside activities that may overlap with your company's operations or domain (working for the competitor, sharing confidential information, or using company assets).

What Should an Employee Moonlighting Policy Cover?

The following template will help you write a moonlighting policy -

1. Statement of purpose: We recognize employees' aspirations, yet, we need to address some risks. 
2. Definition: You need to define what moonlighting means for your company. Moreover, you may define dual employment, outside employment, freelance work, consulting, business, and other related terms.
3. Disclosure requirement: Your policy may demand employees to declare moonlighting activities.
4. Conflict of interest: What should an employee avoid when moonlighting outside the main job?
5. Company time and resources: You must emphasize that your company resources shouldn't be used by an employee when moonlighting.
6. Performance expectation: You can specify that outside activities shouldn't affect employee performance negatively.
7. Information security obligation: You must remind employees of confidentiality obligations.
8. Employee device use and monitoring: This section should address the possibility that the organization will monitor employee devices. You need to clarify whether you monitor mobile devices and describe what information you collect.
9. Requesting permission for outside work: You can list all the parties that may approve an employee's request to start outside activities.
10. Penalties: Finally, you need to write down penalties for failing to comply with your moonlighting policy.

CTA box: Download our free employee monitoring policy template - a ready-to-customise document covering monitoring scope, acceptable use, disclosure requirements, and employee rights. Used by 700+ HR teams. → [Download free template] 

How Workforce Monitoring Software Helps Detect Employee Moonlighting?

Workforce monitoring software like CurrentWare can provide you with the visibility to discover employee activities. Monitoring software is a tool that can track applications' usage, browser history, file transfers/downloads/uploads, peripheral and USB activity, and other information. 

Why is it needed? 

Because many moonlighting investigations start with a hunch, a missed deadline, or poor employee performance. CurrentWare helps you detect patterns of activity associated with moonlighting. For instance:

• An employee works hard throughout a business day, but productivity is low, thus, patterns of application and web usage must be analyzed.
• A remote employee constantly becomes unavailable during business hours, thus, activity patterns must be compared to planned schedules.
• An employee works on other projects using company equipment; thus, activity reports regarding applications and websites may show this activity.
• A moonlighter is an insider threat; file transfer and USB usage may help the security team investigate data exchange activities.

Procedures for Handling a Confirmed Case of Employee Moonlighting

After obtaining sufficient proof, act carefully.

1. Establish the facts: Write down dates, patterns of activity, terms of any policy violation, impact on employee's performance, security issues, and previous communications. Keep emotions away from the process.

2. Check policy and employment contract: Is there any violation of the employee's written agreements regarding confidentiality, conflict of interest, acceptable use policy, or schedule requirements?

3. Evaluate the case severity: It does not mean that every case requires equal action. Evaluate such factors as:

• Whether or not moonlighting was disclosed
• When it happened, during or after work hours
• Whether a competitor was involved
• The usage of company equipment
• Whether confidential information was accessed or exchanged
• Impact on performance
• Data transfers
• First offense or repeated violation

4. Talk to the employee: Give the employee an opportunity to give his or her explanations. Sometimes there might be a completely harmless situation, some misunderstanding, or misconduct. In any case, the talk should happen before making a decision.

5. Choose a response: Potential steps you can take include:

• Informal reminder to follow the policy
• Approval of the disclosure and its compliance
• Resolution of a conflict of interest
• Clarification of the schedule
• Performance improvement plan
• Limitation of access to company resources
• Device audit
• Formal notice
• Termination of the employment contract

Your chosen response must be in accordance with the degree of danger in the case. It would be unreasonable to react in the same manner to a minor undeclared side gig vs moonlighting for a competitor using company equipment.

Conclusion

Moonlighting should not trigger moral panic. Having said that, secret double employment, working for competitors, abusing corporate technology, and uncontrolled data transfer are major business concerns.

Organizations which manage this problem well in 2026 will gain long term advantage as a trusted employer brand. Policies, disclosure, sensible supervision, and employee monitoring software will enable organizations to tell the difference between acceptable moonlighting and real insider threats. A combination of these would form a part of the right approach. Trusting when you can and verifying when required.