Detection Rates for Remote Workers Abroad: What The Data Says

"How often do people actually get caught working abroad?" is the question you were looking to answer. The honest reply is that "caught" hides at least six different mechanisms, and they don't fire at the same rate. This guide separates them.

The one number people cite

The Headline Rate: 37%

37% of quiet-vacation takers say the employer eventually found out. Not 37% per trip. That's a lifetime rate across many trips, and self-disclosure drives most of it.

41%

of full-time US workers took a "quiet vacation" in the previous 12 months [1]

37%

of them say the employer eventually found out [1]

16%

of those found out were fired [1]

Resume Builder's May 2024 survey of 1,067 full-time US workers is the most-cited data point in this space [1]. It's the number every trend piece leans on. But two things about that headline get missed.

First, it aggregates. A quiet vacationer isn't necessarily abroad. The survey covers any working-while-supposedly-off pattern: from a beach in Florida, a cabin in Vermont, or a rental in Lisbon. The 37% detection figure is not a per-country or per-trip rate.

Second, "found out" bundles all mechanisms together. Self-disclosure, a suspicious Slack timezone, an ex-coworker mentioning something in passing, a monitoring alert, and an IT audit all count equally. Some of these are much more likely than others.

The headline detection rate is real. What it measures is not what most people assume it measures.

Split the headline number apart

Detection Mechanisms, Ranked

Six distinct mechanisms produce "found out." Their contribution to the headline 37% is very unequal.

Signal 1

Self-disclosure

By far the largest contributor

The dominant catch mechanism, and the most under-appreciated one. It's a person telling their manager, a coworker, or the internet. A LinkedIn post captioned "writing from Lisbon." A Slack aside about the coffee. A vacation-photo repost that says too much.

MBO Partners' State of Independence 2025 found that 13% of digital nomads holding traditional employed jobs say their employer does not know they work nomadically [2]. The rest either have permission or are relying on their employer to remain uninterested. Self-disclosure is the fastest way to move from column two to column one.

The Paris labor case in 2024 followed exactly this path. The court upheld a dismissal for gross misconduct where the employee, working from Canada, disclosed her own location and refused to return. Detection was not a technical event. It was a conversation.

Signal 2

Public-IP geolocation

The most-checked automated signal

Every corporate SaaS product logs the public IP of every session. Slack, Microsoft 365, Google Workspace, Okta, Salesforce, GitHub, banking portals. Each of those records where the request came from at the country and often city level.

Detection here is not about a human looking at a log. It's about a rule. Microsoft's Impossible Travel risk detection in Entra ID compares each sign-in against the recent history and fires an alert when two sign-ins are physically too far apart to travel between in the elapsed time [3]. That detection is on by default for tenants with the right licensing.

This is the signal HomeLink addresses at the router level. Traffic exits through the customer's home connection, so the public IP on every session stays consistent regardless of where the laptop physically sits.

Signal 3

MFA "unusual sign-in" prompts

User-facing, easily noticed

A parallel effect of the IP-geolocation signal. Identity providers respond to a country change by escalating the sign-in challenge. What was a silent single-factor prompt becomes an email verification, a phone push, or a hardware-key tap. The user notices. The security team notices, because those events are logged and often reviewed.

Impossible-travel detections and unusual-country sign-in prompts frequently share the same underlying risk score in Entra ID, Okta, Duo, and comparable stacks [3].

Signal 4

Device-side location (MDM, EDR)

Grows with company size

Jamf, Intune, Kandji, and comparable device-management platforms can read location independent of the network path. GPS on macOS and iOS, IP-based location on Windows through the LocationSettings API, Wi-Fi BSSID lookups that don't care about the tunnel. EDR products (CrowdStrike, SentinelOne) frequently capture similar telemetry.

This is the signal that a network-layer fix does not touch. Enterprises with strict device management can locate the endpoint even when the traffic looks pristine. Adoption is heavier at larger firms. In small and mid-market companies it's less common and less consistently reviewed.

Signal 5

Application-layer metadata (timezone, keyboard, locale)

Passive, but adds up

Slack profile timezone shifts. Google Workspace calendar events created in a foreign timezone. Windows or macOS keyboard layout changes. Language-code hints in HTTP headers. None of these are conclusive on their own. Any one of them fires false positives on legitimate travel.

In aggregate, they widen the surface. A worker who's carefully routed their public IP through home but let their OS clock update to Central European Summer Time has left one obvious flag in every calendar invite they send.

For deeper coverage of this specific layer see how your work apps reveal your timezone.

Signal 6

Dedicated employee-monitoring software

Prevalent, but not universal

Hubstaff, Teramind, ActivTrak, Time Doctor, and similar products explicitly track worker location and activity as their main function. They are common in customer-support, BPO, and hourly-billing contexts. They are far less common in white-collar salaried roles at mid-market firms.

Grand View Research values the global employee-monitoring software market at $1.48 billion in 2025 with an 11.3% CAGR, projecting roughly $2.8 billion by 2030 [4]. Growth is real but concentrated: some workforces are heavily monitored, others essentially not at all.

The network layer, closed cleanly.

HomeLink ships a paired router kit that keeps your public IP anchored to home even when the laptop travels. It closes Signal 2 and by extension most of Signal 3. Device-side signals stay your responsibility.

Start your free trial →

The signal enterprise SOCs actually watch

A Closer Look at Impossible-Travel Detection

Impossible-travel alerting is the single most-cited automated detection for cross-border work. It's enabled by default in enterprise-tier Entra ID.

Microsoft's Entra ID Protection product ships a risk detection called Impossible Travel. Its own documentation describes the mechanic clearly: for each sign-in, the risk engine compares the geolocation against recent history, and if the physical distance between two locations exceeds what could reasonably be traveled in the elapsed time, the sign-in is flagged as risky [3].

Two properties of the detection deserve attention because they cut against the intuitions most workers have.

The rule fires on sign-in patterns, not on a static "you're abroad" test. Which means a laptop that's been in Portugal for three months and never logs in from anywhere else does not trip Impossible Travel. What trips it is changing locations too fast: a US-East sign-in at 9:00 and a Lisbon sign-in at 10:15 on the same account.

Anonymous-proxy and VPN traffic can produce false negatives in the opposite direction. Microsoft explicitly notes that when both sign-ins come from VPN or proxy exits with unclear geolocation, the detection may not fire even though the person actually moved [3]. That's not a marketing point for VPNs. It's an acknowledgement that the detection has known blind spots that security teams tune around, not away from.

Impossible-travel fires on transitions. Steady-state foreign presence is a different problem.

Practical implication: the highest-risk moment is the transition itself. A worker who lands in Lisbon and opens Slack from an airport hotel's Wi-Fi before their VPN or home-IP relay is fully up produces exactly the pattern Impossible Travel is designed to catch. Two hours later, once traffic is routing through home, the flag has already been raised.

What happens after detection

Detection Outcomes: Not Just Termination

Being caught is not the same as being fired. Termination is one outcome in a distribution that includes several softer consequences.

Resume Builder's 2024 survey asked respondents whose quiet vacation was discovered what happened next. The distribution is roughly [1]:

• 30% were denied a promotion

• 29% lost a key project

• 27% were denied a raise

• 16% were fired

These categories are not mutually exclusive. Someone denied a promotion and then denied a raise on the next cycle counts in both. The consequences also stack: a "reprimand" that shows up as three of the four categories the following year is functionally a career slowdown.

Two important framings the raw distribution doesn't capture.

Termination probability rises with duration. A single week is a soft-consequence event in most surveys. A three-month unauthorized stay in a country the employer specifically excluded is the fact pattern that produced the 2024 Paris dismissal-for-gross-misconduct ruling. The 16% termination rate is a lifetime average across all quiet-vacation patterns, not the outcome at three months in Portugal.

Termination probability rises with role sensitivity. Compliance-sensitive workers (financial advisors, healthcare, government-adjacent roles, cleared roles) face materially higher consequences per event than a marketer or a designer. The survey averages don't disaggregate by role.

The 63% figure people miss

What The Data Also Says: 63% Aren't Caught

Symmetrical read of the same survey: 63% of quiet vacationers say the employer never found out. The distribution is genuinely bimodal.

The same Resume Builder survey that produced the 37% headline also implies that 63% of quiet vacationers report the employer did not find out [1]. This is not a stat we've seen anyone else lead with. It's worth taking seriously in either direction.

Read one: the majority who don't get caught reflect the fact that most quiet vacations are short, domestic, and don't trigger any of Signals 2 through 6. A long weekend at a lake house is a very different fact pattern from a month in Bangkok.

Read two: even in fact patterns that would trigger Signal 2 (an Airbnb in Lisbon for two weeks), a nontrivial fraction of workers avoid detection because their employer isn't running Impossible-Travel, isn't monitoring Slack timezones, and isn't reviewing IP logs. Detection capability is not evenly distributed across employers.

The honest read is that both are true. If you have a Signal 2-6 hygiene plan and are outside the compliance-sensitive roles, the detection base rate for a short stay is likely well below the headline 37%. If you are inside a compliance-sensitive role at a large firm with the full detection stack, it's likely above.

Where the numbers are moving

The Trend Line: Detection Is Getting Cheaper

Enterprise detection capability compounds year over year. A stay that's undetectable in 2026 is not necessarily undetectable in 2028.

Three trend lines matter for anyone thinking about this beyond a single trip.

Employee-monitoring adoption is growing 11% per year. Grand View Research's forecast implies a near-doubling of the addressable market by 2030 [4]. That growth is not evenly distributed, but the direction is consistent.

Identity-provider risk features are becoming default rather than optional. Impossible-travel-style detections that required premium licensing in 2020 now ship as standard behavior in Entra ID and Okta at the tiers most mid-market firms already pay for [3]. That's not a marketing move. It's platform default-on drift.

Cross-border data infrastructure is filling in on the tax side. The OECD's November 2025 Model Tax Convention update introduced a new remote-work framework with a 50% working-time safe harbor and a commercial-reason test [5]. That framework is the analytical baseline national tax authorities will use going forward. It doesn't change short-trip detection rates today. It does change what "caught by paperwork" looks like at three years out.

For the broader trend, see the shadow workation trend and the honest 2026 guide.

Concrete implications

What The Numbers Suggest You Should Actually Do

Three things dominate the actual outcome curve: don't self-disclose, control the public-IP signal, and accept that device-layer signals stay yours to manage.

Silence beats sophistication. Since self-disclosure is the largest contributor to the 37% headline, no network configuration in the world protects a person who tags their location on Instagram. The single highest-leverage intervention is behavioral, not technical.

Anchoring the public IP does most of the technical work. Impossible-travel, MFA prompts, and SaaS geolocation logs all read from the same field: the source IP on the request. Keeping that field consistent removes the fastest and most-monitored signal. HomeLink is designed specifically for this.

Device-layer signals are not solvable by network changes. An MDM-managed laptop can report its Wi-Fi BSSID, its GPS, and its OS locale regardless of how the traffic is routed. If the device is company-managed, the honest answer is to accept device-side visibility, and to time your travel to fact patterns your employer's monitoring stack doesn't fully cover.

The system that shows you're home.

One router stays home, one goes with you. Every device you connect to the travel router looks home. No apps, no toggles, no VPN.