--- title: "Mouse Jigglers at Work: Dated Public Cases" description: "Review dated EPA, Wells Fargo, and federal court records involving mouse jigglers, separating verified records, reported dismissals, policy, and unknowns." canonical: "https://idlepilot.com/research/mouse-jigglers-at-work-public-cases/" updated: "2026-10-28" generated_by: "scripts/build-markdown-twins.mjs" --- > Markdown representation of https://idlepilot.com/research/mouse-jigglers-at-work-public-cases/ — the HTML page at that URL is canonical and carries the same content. # Mouse jigglers at work: what dated public cases establish Public records establish specific incidents, not a universal detection rule. EPA's inspector general reported 120 employees and contractors using jiggler software after scans in two regions in November and December 2024. Other records concern reported Wells Fargo dismissals and a separate work-session security allegation. This review distinguishes official findings, news-attributed employer statements, and court allegations; their counts and outcomes cannot be combined. Sources: [EPA OIG: Management Implication Report: Unauthorized Use of Software on EPA Computers, 25-N-0049](#source-epa-report) ; [Reuters: Wells Fargo fires more than dozen employees for allegedly faking work, Bloomberg News reports](#source-reuters-wells) ; [US District Court, SDNY: 2023 insider-trading indictment, paragraphs 13–16](#source-court-indictment) Last updated: October 28, 2026 Selective US record review checked October 28, 2026: a 2023 indictment, reported May 2024 dismissals, and a 2025 EPA report on late-2024 scans. Later policy and dated Scottish commentary are separate context. ## Findings you can cite | Finding | Value | What it measures | | --- | --- | --- | | EPA incident | 120 employees and contractors; two regions | November–December 2024 software finding, published September 2025; no full scanned-population denominator or dismissal total in the summary. Sources: EPA OIG: Management Implication Report: Unauthorized Use of Software on EPA Computers, 25-N-0049 | | Wells Fargo dismissals | More than a dozen, according to Reuters' June 13, 2024 report | Reuters attributed disclosure details to Bloomberg and reported an employer statement directly. Original individual disclosures were not independently reviewed here. Sources: Reuters: Wells Fargo fires more than dozen employees for allegedly faking work, Bloomberg News reports | | Court record | A separate security allegation, not a jiggler dismissal | The indictment alleges an unlocked-session information-access chain. It does not establish that activity simulation generally causes a criminal offense. Sources: US District Court, SDNY: 2023 insider-trading indictment, paragraphs 13–16 ; US DOJ: June 29, 2023 announcement of four separate insider-trading cases | | Rate of use or detection | Not established | The selected incidents have different populations and evidence types. There is no common denominator for an employee prevalence or detection-success calculation. Sources: EPA OIG: Management Implication Report: Unauthorized Use of Software on EPA Computers, 25-N-0049 ; Reuters: Wells Fargo fires more than dozen employees for allegedly faking work, Bloomberg News reports ; US District Court, SDNY: 2023 insider-trading indictment, paragraphs 13–16 | ## Three records, three different kinds of evidence The record type controls what can be said. An inspector-general report is a primary oversight finding. A news report describing regulatory disclosures remains attributed reporting when the underlying individual records have not been inspected. An indictment records prosecutors' allegations, and a company policy states expectations rather than documenting an incident. This table keeps event dates separate from publication dates. It also states what is missing, so that readers do not confuse a historical finding with a 2026 count, an allegation with a judicial conclusion, or a detected installation with a dismissal. | Record and dates | What is supported | What remains unknown or excluded | | --- | --- | --- | | EPA OIG report 25-N-0049; published September 22, 2025; scans November–December 2024 | Software identified among 120 employees/contractors in two EPA regions. | Scanned-population denominator and individual employment outcomes are not given in the reviewed summary. | | Wells Fargo; reported June 13, 2024; dismissals in May 2024 | Reuters reported more than a dozen dismissals following allegations of simulated keyboard activity. | Hardware/software used, detection method, exact total, and home/office location were not established in that report. | | Federal indictment associated with DOJ's June 29, 2023 announcement | A mouse jiggler was alleged to keep an executive assistant's laptop session unlocked in an information-access chain. | This is not a presence-monitoring trial, workplace dismissal finding, or general ruling about jigglers. | Sources: [EPA OIG: Management Implication Report: Unauthorized Use of Software on EPA Computers, 25-N-0049](#source-epa-report) ; [Reuters: Wells Fargo fires more than dozen employees for allegedly faking work, Bloomberg News reports](#source-reuters-wells) ; [US District Court, SDNY: 2023 insider-trading indictment, paragraphs 13–16](#source-court-indictment) ; [US DOJ: June 29, 2023 announcement of four separate insider-trading cases](#source-doj-announcement) ## EPA: a primary software-discovery record EPA OIG's report summary identifies unauthorized jiggler software and says removal timing differed between regional offices. It also reports that some IT specialists believed they were exempt from policy. Those findings concern authorization and implementation of security controls. The summary supports a concrete instance of software discovery. It does not establish that every affected person simulated a full workday, failed to complete work, or received the same consequence. We do not infer those individual outcomes. Sources: [EPA OIG: Management Implication Report: Unauthorized Use of Software on EPA Computers, 25-N-0049](#source-epa-report) ## Wells Fargo: dismissals reported through a source chain Reuters described employees in the wealth and investment management unit and attributed the FINRA disclosure details to Bloomberg. A Wells Fargo spokesperson separately told Reuters that the company expected high standards and did not tolerate unethical behavior. The article said it was unclear whether the alleged activity occurred from home. It did not establish a jiggler model or detection technique. We therefore retain simulated keyboard activity as the allegation and do not convert the story into a tested hardware-detection claim. Sources: [Reuters: Wells Fargo fires more than dozen employees for allegedly faking work, Bloomberg News reports](#source-reuters-wells) ## A court filing: an unlocked session creates a different issue Paragraphs 13–16 of the federal indictment describe remote access to an executive assistant's work environment through a personal laptop. The filing alleges that a mouse jiggler helped keep the session from locking, and that confidential information was later accessed without the assistant's knowledge or permission. That record adds a security context distinct from apparent availability. We describe what the historical indictment alleged, without naming the assistant, treating the assistant as a defendant, or reporting a present case disposition. A claim about preventing a lock is not evidence that an employer detected a false green dot. Sources: [US District Court, SDNY: 2023 insider-trading indictment, paragraphs 13–16](#source-court-indictment) ; [US DOJ: June 29, 2023 announcement of four separate insider-trading cases](#source-doj-announcement) ## What an employer's published policy adds Wells Fargo's accessible Code of Conduct is labeled February 2025. It tells employees to protect company laptops and other assets, safeguard credentials, and prevent unauthorized people from using company equipment. Its scope includes office, remote, and travel contexts. That is a primary statement of expectations as published in 2025. It is not the exact disciplinary file or the policy version applied to the May 2024 dismissals. We do not backdate it or claim its general asset-security provisions specifically name mouse jigglers. Readers need the applicable policy and version to assess a particular workplace rule. Sources: [Wells Fargo: Code of Conduct, February 2025, protecting assets and information security](#source-wells-code) ## What the dated legal commentary can and cannot add In July 2024, Scottish law firm Wright, Johnston & Mackenzie discussed the Wells Fargo story in its own commentary. It emphasized transparency and context in monitoring and suggested examining productivity and outputs. That is attributed professional commentary, not an additional confirmed dismissal or a court judgment. The article expressly locates its understanding in July 2024. We do not use it as a statement of every jurisdiction's current law, as a forecast of an individual's employment outcome, or as a substitute for the primary incident records. This study provides historical evidence, not legal advice. Sources: [Wright, Johnston & Mackenzie: commentary on monitoring after mouse-mover sackings](#source-wjm-commentary) ## How to read a future mouse-jiggler headline Check whether the source describes installation, a running application, suspected input patterns, an unlocked session, or admitted misconduct. Those are different observations. Then look for an employer statement, published oversight report, or court document, and separate that source from later commentary. Keep the denominator attached to any number. A total in two agency regions is not a national workforce estimate; a group of reported dismissals is not a rate; and several articles about one incident are not several independent cases. Missing location, device, and outcome details should stay missing rather than be reconstructed from a headline. Cite this page as Idle Pilot's selective public-record review checked October 28, 2026. For the underlying facts, cite the dated record itself. We did not interview employers, perform experiments, inspect personnel files, or independently verify the people behind reported allegations. Sources: [EPA OIG: Management Implication Report: Unauthorized Use of Software on EPA Computers, 25-N-0049](#source-epa-report) ; [Reuters: Wells Fargo fires more than dozen employees for allegedly faking work, Bloomberg News reports](#source-reuters-wells) ; [US District Court, SDNY: 2023 insider-trading indictment, paragraphs 13–16](#source-court-indictment) ## Method Searched dated public employer, oversight, court, and news records for jigglers or simulated input; prioritized accessible originals. Included three distinct workplace-software/session records. Retained Reuters attribution because individual Wells Fargo FINRA disclosures were not independently inspected. Used the 2025 employer code and 2024 law-firm commentary only as separate context, not as two additional incidents or as retrospective proof of the 2024 policy. Separated event and publication dates; no summed populations, rates, non-public identities, or exhaustive-case claim. This is document review. No original experiment, technical detection audit, legal determination, or customer-data analysis was performed. ### Limitations - Selection favors incidents that became public and were accessible. Unreported incidents and internal decisions cannot be counted. - The EPA summary lacks a scanned-population denominator and individual outcomes; its count is historical. - Wells Fargo individual disclosures were not reviewed directly; dismissal details retain Reuters/Bloomberg attribution. - The indictment is used for its historical allegation and session-security context. We did not reconstruct the complete later docket or make a current disposition claim. - Workplace policy, jurisdiction, authorization, evidence, and circumstances differ. These records cannot establish what every employer can detect or what consequence applies to a reader. ## What we could not establish - All 120 people in the EPA finding were fired or proved to have committed time fraud. - The Wells Fargo incident demonstrates a particular brand of hardware jiggler being detected by Teams or Slack. - The cited indictment creates a general rule that owning or using a jiggler is a criminal offense. - These selected public records establish a global count, representative detection rate, or universal employment consequence. ## FAQ Have people been fired over simulated work activity? Reuters reported more than a dozen Wells Fargo dismissals in May 2024 following allegations of simulated keyboard activity. The underlying disclosure details remain attributed reporting in this review, rather than records we independently inspected. Did EPA say 120 people were fired? No such outcome is stated in the reviewed report summary. Its count concerns employees and contractors identified using jiggler software after scans in two regions during late 2024. Do these cases prove all employers detect jigglers? No. A specific software-discovery incident and a reported dismissal group have neither universal coverage nor a common denominator. They do not measure another employer's tools or detection success. Why include an insider-trading court filing? It describes an alleged jiggler-assisted unlocked work session, which illustrates a different security context. We do not count it as a jiggler dismissal, name the non-public employee, or treat an allegation as a finding against that employee. Is the 2025 company code proof of the 2024 dismissal policy? No. It is a later, dated statement of general asset and information-security expectations. Establishing the exact rule applied in 2024 would require the applicable historical policy and decision record. Can this review tell me the legal outcome of using one? No. The records concern different facts, jurisdictions, dates, and evidence types. The law-firm material is attributed historical commentary. This review does not give legal advice or predict an individual outcome. ## Sources and citation notes Cite the original source and its date for each figure. For our own studies, include the sample and limitations above. 1. [EPA OIG: Management Implication Report: Unauthorized Use of Software on EPA Computers, 25-N-0049](https://www.epa.gov/office-inspector-general/report-management-implication-report-unauthorized-use-software-epa) Published: 2025-09-22; summary page last updated 2026-04-28 Population or sample: 120 employees and contractors identified in two EPA regions; full scanned-population denominator not disclosed in reviewed summary Scope: United States EPA; network scans November and December 2024; authorization and removal concerns, not a published count of dismissals Checked: 2026-10-28 2. [Reuters: Wells Fargo fires more than dozen employees for allegedly faking work, Bloomberg News reports](https://www.investing.com/news/stock-market-news/wells-fargo-fires-more-than-dozen-employees-for-allegedly-faking-work-bloomberg-news-reports-3483325) Published: 2024-06-13; updated the same day Population or sample: Reported group exceeding 12 wealth/investment management employees; exact total and investigated-population denominator not disclosed Scope: US bank; reported dismissals May 2024. Reuters via Investing.com, attributing FINRA disclosures to Bloomberg; employer statement reported directly by Reuters Checked: 2026-10-28 3. [US District Court, SDNY: 2023 insider-trading indictment, paragraphs 13–16](https://www.justice.gov/usao-sdny/file/1303021/dl?inline=) Published: 2023 indictment; associated DOJ public announcement 2023-06-29 Population or sample: One alleged information-access chain involving an unnamed executive assistant's work session; not a worker survey Scope: New York federal criminal allegation; remote work context beginning in 2020. Historical charging document, not a current docket-disposition review Checked: 2026-10-28 4. [US DOJ: June 29, 2023 announcement of four separate insider-trading cases](https://www.justice.gov/usao-sdny/pr/us-attorney-announces-charges-four-separate-insider-trading-cases-against-10) Published: 2023-06-29 Population or sample: Multi-case charging announcement; only the work-session information-access chain is relevant here Scope: Southern District of New York; source dates and context for historical allegations, not an employment ruling Checked: 2026-10-28 5. [Wells Fargo: Code of Conduct, February 2025, protecting assets and information security](https://www.wellsfargo.com/assets/pdf/about/corporate/code-of-conduct.pdf) Published: 2025-02 Population or sample: Published employer policy; no incident sample or disciplinary denominator Scope: Wells Fargo workforce policy as labeled February 2025; particularly page 16. Not verified as the policy version applied in May 2024 Checked: 2026-10-28 6. [Wright, Johnston & Mackenzie: commentary on monitoring after mouse-mover sackings](https://www.wjm.co.uk/news/wjm-employment-lawyer-advises-workplaces-over-monitoring-of-workers-after-mouse-movers-sackings/) Published: 2024-07-03 Population or sample: Law firm's own professional commentary; no independently documented new incident population Scope: Scotland/UK professional perspective as of July 2024, discussing a US reported incident. Not a court decision or current multi-jurisdiction legal survey Checked: 2026-10-28 ## Related guides and tools - [Review documented monitoring capabilities](https://idlepilot.com/research/can-employers-detect-mouse-jigglers/) - [Compare documented idle behavior](https://idlepilot.com/research/presence-timeouts-in-work-chat-apps/) - [Understand the differences between tool types](https://idlepilot.com/mouse-jiggler-alternatives/) ## Keep Slack or Teams Available during saved hours, even with your computer off. [Try Idle Pilot free](https://app.idlepilot.com) 3-day free trial · No credit card