Summary dismissal for working-time fraud in the home office – what does the employer have to prove?

An accusation of working-time fraud in the home office quickly leads to summary dismissal. What the employer really has to prove, which deadlines are running and when login data can be used as evidence at all.

You work from home. Then the summary dismissal arrives. The accusation: that you recorded working time even though you were not actually working. Perhaps your employer is relying on login records or on mouse movements captured by tracking software. Or simply on the fact that you were unreachable during the period in question. Before you accept this, bear one thing in mind: the employer has to prove this accusation. In practice, that is where such dismissals fail surprisingly often.

In short

A summary dismissal for working-time fraud is only valid if the employer proves the fraud (a dismissal based on established conduct). It is also valid where there is a strong suspicion grounded in objective facts (a dismissal based on suspicion) – provided the employer has first given you the chance to respond. In both cases the burden of proof lies with the employer, not with you. On top of that, the employer must give notice of the dismissal within two weeks of learning of the allegations. If that deadline is missed, the dismissal is invalid on that ground alone – regardless of whether the accusation is actually true.

How I can help you

• I assess whether this is a dismissal based on established conduct or on suspicion – and whether the respective requirements are even met
• I check the two-week deadline: when did the employer actually find out, and was the deadline observed?
• I evaluate whether the login, system or time-recording data put forward can be used as evidence at all
• I bring a claim for unfair dismissal before the labour court in good time

Established conduct or suspicion – the distinction decides who bears the burden of proof

The employer has two routes for relying on working-time fraud. Each has different hurdles:

A dismissal based on established conduct requires the employer to be able to actually prove the fraud – not merely suspect it, but set it out and prove it in court if it comes to a dispute. That means the employer has to show, specifically, that you were not working during particular recorded working hours. And yet you documented precisely that time as working time.

A dismissal based on suspicion is the more common scenario in the home office, because watertight proof often cannot be produced. After all, nobody is watching you not work. Here a strong suspicion, grounded in objective facts, is enough. But that suspicion has to be substantial. It must not rest on mere conjecture: conspicuous gaps in login data alone are usually not enough where there are plausible explanations for them (phone calls, reading work without screen activity, technical faults).

The decisive point: a dismissal based on suspicion is only valid if the employer has first given you the opportunity to respond to the specific suspicion. In doing so, the employer must give you a genuine chance to comment on the allegations. If this hearing is missing, or was carried out only for show, the dismissal is open to challenge on that ground alone. That holds regardless of how strong the suspicion may otherwise be.

What the employer actually has to establish

Under section 626(1) of the German Civil Code (BGB), just any misconduct is not enough for a summary dismissal. There must be facts present. Those facts must be such that the employer cannot reasonably be expected to continue the employment relationship until the ordinary notice period expires. In assessing this, all the circumstances and the interests of both sides have to be weighed against each other. For an accusation of working-time fraud, that means specifically:

• What time exactly was recorded as working time even though no work was performed
• How reliable the evidential basis is (mere inactivity at the computer is no proof that no work was done)
• How serious the breach is – a single, brief incident weighs differently from a systematic, repeated pattern
• Whether a warning would have been sufficient as a milder measure, rather than dismissing outright

It is precisely this last point that is often overlooked in practice. Summary dismissal is the sharpest instrument in employment law. It is only justified where a less drastic measure would not have sufficed. With a one-off incident that is not especially serious, this can be decisive: even a proven breach may then fail to support a summary dismissal.

The two-week deadline under section 626(2) BGB

This is the point at which many summary dismissals founder. And here the substance of the accusation is beside the point. Under section 626(2) BGB, the employer can give notice of a summary dismissal only within two weeks. That period begins the moment the employer learns of the material facts.

Important for your case:

• The period does not start only once the proof is complete. It starts as soon as the employer knows the facts that support the suspicion or the dismissal.
• In the case of a dismissal based on suspicion, the period only runs once the employer has the state of knowledge that matters to them. As a rule, that includes the prior hearing. But if the employer drags out the hearing unreasonably, the period may nonetheless already have started to run.
• Check exactly when the employer first saw the login data or system analyses. That point in time is decisive, not the date the dismissal was issued.
• There must be no idle weeks between knowledge and dismissal. The exception is weeks that the necessary investigation genuinely required.

Once this period has expired, the summary dismissal is invalid on that ground alone. That is so even where the working-time fraud actually took place.

Can login and time-recording data be used at all?

With the planned obligation to record working time electronically, this very question is coming ever more to the fore. What an employer may read out of system logs, VPN logins or activity data is by no means unlimited. Under section 26 of the German Data Protection Act (BDSG), employers may process employee data only under strict conditions in order to uncover criminal offences or serious breaches of duty. Three conditions must be met: documented, actual indications must give rise to the suspicion, the processing must be necessary to uncover the wrongdoing, and the employees’ interests worthy of protection must not outweigh it. In particular, the nature and extent of the measure must not be disproportionate. Article 6 of the GDPR applies in addition, under which every processing operation needs a sound legal basis.

For practical purposes, this means: covert, continuous monitoring “into the blue” with no specific trigger is regularly disproportionate. Where data was gathered in breach of these limits, it often cannot be used as evidence in an unfair dismissal claim. In that case, little often remains of the supposed proof. The question of whether the works council was involved when the monitoring software was introduced can also become relevant here.

A typical case from my practice

An employee working from home receives a summary dismissal. The reason: according to the VPN records, she was not logged in for over two hours on each of three days, even though she had documented her full working time. The employer had already received the analysis three weeks before the dismissal. Only afterwards did they hold a short meeting. In it, they gave her no genuine opportunity to respond to the individual days. On examination it became clear: the two-week deadline had been exceeded. In addition, the hearing was too superficial to meet the requirements for a dismissal based on suspicion. The dismissal could be successfully challenged on these formal grounds alone – regardless of what had actually happened on the three days.

Common mistakes

• Reacting too late. Some only have it checked by a lawyer weeks later whether the two-week deadline was observed. By then their own deadline for bringing a claim has often already passed.
• Explaining too much at the hearing without knowing the allegations. As long as it has not been specifically established which times and which data are meant, you should not go into detail. First ask for access to the file or for specific particulars.
• Accepting the dismissal as “certainly valid” because login data are “facts, after all”. Login gaps prove technical inactivity, not automatically that no work was done.
• Failing to document what you actually did during the period in question (phone calls, fieldwork, reading work) – that is exactly what can later rebut the suspicion.

If you want to challenge the dismissal, the most important date is already fixed in any event. Under section 4 of the Unfair Dismissal Act (KSchG), you must bring a claim before the labour court within three weeks of receiving the written notice of dismissal. With that claim you have it established that the employment relationship was not brought to an end by the dismissal. This deadline runs regardless of whether the dismissal was obviously flawed. It takes effect whenever you fail to bring a claim in time. So have it clarified straight away when the employer learned of the allegations. Check, too, how the hearing was conducted and whether the data put forward can be used as evidence. That way the claim can be brought in time and with the right arguments. For a first overview of the three weeks now running, you will find the details on the deadline for bringing a claim here.

Frequently asked questions

Is a single conspicuous day in the login records enough for a summary dismissal?

As a rule, no. A single incident usually only supports a summary dismissal where it is especially serious or forms part of a repeated pattern. Otherwise a warning, as the milder measure, would generally have taken priority.

Do I have to respond to the allegations at the hearing?

No, there is no obligation to do so. But before you respond, you should ask which times and which data exactly are meant. Alternatively, you can decline to comment altogether.

What happens if the employer analysed the login data without the works council’s knowledge?

That can make the data additionally open to challenge, where the works council should have been involved in introducing the monitoring. This has to be examined on the facts of the individual case and can be a further line of attack against the dismissal.

Can the employer later give ordinary notice again on the basis of the same accusation?

That is possible. The precondition: the summary dismissal fails on the two-week deadline or the hearing. But the accusation is pursued further, and the deadline for giving ordinary notice is still open. This depends on the individual case. It does not, however, alter the fact that the original summary dismissal may itself remain invalid.

What if I cannot rebut the allegations myself?

Even then it is worth examining the deadline and the hearing. For the dismissal may be invalid on formal grounds alone. In addition, it is often possible to negotiate a severance payment or an end date. That is especially so where neither side wishes to continue the employment relationship in any case.

This article provides general information and is no substitute for legal advice in an individual case. Last updated: 2026-09-26.

Christian Czirnich, Rechtsanwalt (attorney at law), Kirchseeon near Munich

Tell me about your case – I will look into it.

I read every message myself and usually reply on the next working day. What you write to me is covered by legal professional privilege from the first word, even if no engagement comes about. The initial assessment is free of charge.

Website

Your messageHow can I reach you? *Phone or e-mailYour name (optional)

Send messagePrefer to call? 08091 617 7777

Encrypted in transit, stored encrypted, readable only by me. Details in the privacy policy.