Social media has transformed the evidence landscape in sickness absence investigations. Employees who are absent from work claiming incapacity and who simultaneously maintain an active social media presence are, in many cases, generating a real-time record of their actual activities during the absence period — a record that is publicly available, easily preserved, and directly relevant to the question of whether their reported condition is genuine.
In my experience, social media evidence is one of the most productive sources in sickness fraud investigations, not because employees are careless, but because the habitual nature of social media use means that the absence of any particular concern about the employer seeing their activity is rarely registered. The employee who posts a photograph from a day out while on sick leave is not typically making a calculated risk assessment. They are doing what they do every day, without thinking about the implications.
How Social Media Creates Evidence
Social media creates evidence in several distinct ways, each of which is relevant in a sickness investigation context.
Photographic content: photographs posted during the absence period that show the employee engaged in physical activities, present at locations inconsistent with their reported incapacity, or visibly well and active when they have reported being unwell. A photograph is a timestamped record of what the employee was doing at a specific point in time.
Location check-ins and geotags: explicit location tags in posts, or embedded geolocation data in photographs, that place the employee at locations inconsistent with their reported absence. An employee who is reported absent and geographically local but who is tagged at a stadium, an airport, or a holiday resort has, through their own social media activity, provided evidence of their actual whereabouts.
Event attendance and RSVPs: event attendance confirmed through social media platforms, which can establish that the employee planned and attended an event during their reported absence period.
Work-related activity: posts that suggest the employee is working during their absence — LinkedIn updates about a new role or project, posts about business activities, or content that is clearly produced in a working context — are particularly significant where the claim is for sick pay.
Inconsistent health representations: posts that describe the employee as well, active, or engaged in activities that are difficult to reconcile with a serious illness or injury that prevents work attendance.
Common Mistakes Employees Make
Failing to review privacy settings: the most common mistake. Many employees do not realise that their privacy settings do not limit what can be seen by a professional investigator conducting a structured review of publicly available content, or that content shared in ‘friends of friends’ settings may be visible to a wider audience than they intend.
Sharing location data through photographs: photographs uploaded to social media platforms often retain embedded EXIF data, including geolocation information, even when the user believes they have disabled location tagging. A photograph taken on a smartphone typically contains precise GPS coordinates that can be extracted from the image file.
Being tagged by others: an employee who has carefully restricted their own posting during an absence period may still appear in content posted by friends, family, or colleagues, in which they are tagged or identified. Tags posted by others are often in less privacy-restricted settings than the employee’s own profile.
Not accounting for the temporal record: social media platforms maintain a dated record of all activity. A post from two years ago that establishes an employee’s physical capacity may be relevant to a current claim. A history of posts may reveal a pattern that is significant even where no individual post is decisive.
Legally Obtaining Evidence
Social media evidence gathered for use in a sickness fraud investigation must be obtained through lawful means. The legal requirements that apply are:
- Only publicly available content should be gathered without the individual’s consent. Accessing private profiles, messaging accounts, or content not publicly visible through the use of false identities or technical means is unlawful and may itself constitute a criminal offence.
- The gathering and storage of social media evidence must comply with UK GDPR. The personal data contained in social media posts is subject to the data protection framework, and its processing for the purpose of an employment investigation must have a lawful basis.
- The evidence must be preserved accurately. Screenshots should be taken in a manner that captures the URL, the platform, the date and time of the post, and the privacy settings visible at the time of gathering. The evidence should not be edited, cropped to remove context, or presented in a form that does not accurately represent what was publicly visible.
- The investigator should not interact with the employee or their connections in any way that could be characterised as entrapment, solicitation, or deceptive conduct.
Corroborating Findings
Social media evidence is most powerful when it corroborates other evidence rather than standing alone. A photograph that shows an employee at a sporting event during their absence is significant; combined with surveillance footage of the employee attending that event, it becomes decisive. A LinkedIn post suggesting an employee is working during their absence is significant; combined with Companies House records confirming a directorship in a company that trades in the relevant period, it provides a much stronger evidential case.
The investigation approach we adopt is to treat social media evidence as an intelligence source that directs the investigation as much as it contributes to its findings. A photograph posted to social media that establishes the employee’s likely location during an absence period may direct surveillance activity to that location, producing direct observational evidence that can be presented alongside the social media material.
Presenting Evidence
Social media evidence that has been properly gathered and preserved should be presented as part of the investigation report, alongside any surveillance footage, witness statements, and other evidence gathered. The presentation should include the platform, the date and time of each item of content, the privacy settings that were visible at the time of gathering, and a clear description of what the content shows and why it is relevant to the investigation.
In a disciplinary hearing, the employee must be given a genuine opportunity to see and respond to the social media evidence before any decision is made. They may dispute the interpretation of the evidence, provide context, or raise other matters that affect the weight to be given to it. The fact that social media evidence exists does not replace the disciplinary process; it provides the factual foundation on which the process is built.
Need social media evidence gathering for a sickness investigation? Contact iSpy Detectives for specialist open source investigation services.