This issue: what stealth remote work actually risks — job, taxes, and legal status — and where the line sits between reasonable privacy and real exposure.

If you're working internationally without your company knowing — or actively making sure they don't find out — this is the full picture. Not a listicle of VPN tips, not a moral judgment. What it actually is, why people end up here, what it actually risks, and where the real failure points are.

It's not one behavior. It's a spectrum, and where you sit on it changes everything else in this piece.

It's rarely a plan. It's usually a mismatch between a rigid policy and a life someone's already decided to build.

Company policy says "remote, but only from your home state." The formal request process is slow, unclear, or a flat no. Or there's no process at all — just an unspoken assumption that "remote" means "somewhere we can picture." Meanwhile the actual work — the output, the meetings, the deadlines — doesn't change based on which country you're sitting in.

So people default to just... not mentioning it. Not because they're trying to get away with something, but because disclosure feels like it opens a conversation they don't think they'll win.

That's a reasonable read of the incentives. It's also not the same as a reasonable read of the risk.

Your job. This is the most direct exposure and the easiest to understand. If your contract or company policy specifies a work location — even loosely — working outside it is grounds for termination, regardless of how good your work is. Performance doesn't offset a policy violation in most companies' eyes. This is true even at companies that are otherwise flexible; "flexible" and "undisclosed" are not the same category to HR.

Taxes. This is the one people underweight the most, because it doesn't feel real until it is. Physically doing work inside a country's borders can create tax obligations there — for you personally, and in some cases for your employer too. This is often referred to as "permanent establishment" risk on the corporate side: enough employee activity in a country can trigger corporate tax exposure for the company itself, which is a much bigger problem than one employee's personal taxes, and a much bigger reason to fire someone if discovered. Your paycheck not reflecting your location doesn't mean the country you're sitting in agrees with that framing.

Your legal/visa status. This is a separate problem from employer secrecy, but it usually stacks on top of it. Working while on tourist status — regardless of who technically pays you or where — is its own legal question in the country you're in, independent of whether your employer knows.

Insurance and liability gaps. Health insurance, workers' comp, equipment coverage — most of these are written around a registered work location. Moving outside it doesn't always void coverage outright, but it frequently creates gray areas that only get tested when something actually goes wrong. Nobody reads their policy closely enough to find this out in advance. They find out during the claim.

IT and security monitoring. A VPN by itself isn't inherently suspicious — plenty of people use one for normal privacy reasons. But a lot of companies run automated location-anomaly detection, especially for IT security and compliance reasons unrelated to remote work policy at all. This means the first sign of a problem is often a system flag, not a conversation — and by the time it's a conversation, it's already framed as a security incident, not a policy question.

The human failure mode. This is the least technical risk and probably the most common actual cause. A coworker notices your Slack activity keeps landing at odd hours. Someone tags you in a photo with a location. A comment slips out in a meeting — "oh, it's already dark here." Nobody sets out to expose anyone; it just accumulates until someone connects the dots, and then it's out of your hands.

Not disclosing your location is not the same thing as constructing a false story if someone asks you directly. Those are genuinely different acts, with genuinely different consequences if discovered — one reads as privacy, the other reads as dishonesty, and companies (and people) respond very differently to each.

Most people reading this are somewhere in the middle of that spectrum, not at either extreme. Knowing exactly where you sit changes what you're actually exposed to, and it's worth being precise with yourself about it rather than lumping "I don't bring it up" in with "I'd deny it if asked."

None of this happens the way people picture it. There's no dramatic call from HR, no formal investigation kicked off on day one. It's almost always small and unglamorous — a signal that sits quietly until someone connects it to another signal, and then it's not a maybe anymore.

That's worth sitting with, because it means "I've been doing this for six months with no issues" isn't actually evidence you're in the clear. It's evidence the dots haven't connected yet. The patterns below are grouped by where that signal usually comes from — not because any one of them guarantees discovery, but because this is what accumulation actually looks like in practice.

This isn't about whether you can pull it off. Plenty of people do, for years, without incident. It's about being clear-eyed on what you're actually trading for that — your job security, your tax exposure, your safety net — and deciding, deliberately, whether that trade is worth it to you.

Here's where I land on it: if the reward is bigger than the risk, go for it. That's not a dodge — it's the actual calculation. But you can't run that math honestly without knowing what's really on both sides of it, which is the whole point of this piece.

There's a second decision underneath that one, though, and it's the one people skip: is this a bridge, or is this the plan?

If you're doing this quietly while you build toward something — a business, a client base that isn't tied to one employer, a credential, a legal pathway that lets you actually work where you are — then stealth remote work is a stopgap with an exit date. That's a fundamentally different bet than doing this indefinitely and hoping the questions never come.

Because here's the part that doesn't get said enough: most US remote roles come with a US location requirement, explicit or default. That's not something you out-negotiate by being careful. It means the version of this where you quietly do it forever, undetected, isn't actually the realistic version — the realistic version is that at some point, this job, or the next one, closes that door. If your entire income depends on nobody ever finding out, you don't have a plan. You have a countdown.

So the real question isn't just "am I comfortable with this risk." It's "what am I actually building while I'm taking it." A business that doesn't care where you're logging in from. Income that's yours, not your employer's to gate by geography. A legal pathway that turns "hidden" into "documented" on your own timeline, instead of one forced on you by an IT flag or a slipped comment.

Go for it, if the math says go. Just make sure you're doing the math on both sides — and building something that doesn't need the secret to last forever.

A friend of ours got caught not by IT, not by a policy review, but by a coworker who noticed her "vacation" Instagram story didn't match the beach she said she was at three weeks in a row. No confrontation, no drama — just a slow realization on both ends that everyone already knew.

Before You Go

Reply and tell us. We read every response, and if you're currently living this, we'd genuinely like to hear how you've thought about the trade-off.