An employer must pay for work it suffers or permits. A rule prohibiting unrecorded work does not excuse payment where management knew, or with reasonable diligence should have known, that work was occurring.
Common sources. Answering messages outside shift hours, booting systems before clock-in, closing duties after clock-out, travel between job sites, mandatory training, and remote work performed around childcare hours.
Remote and mobile work has enlarged the problem. Access logs, message timestamps and VPN records provide the evidence that an employer should have known, and they are discoverable.
Reasonable diligence generally means having a reasonable reporting procedure and not preventing or discouraging its use. An employer that provides a channel, publicises it, pays every report promptly, and disciplines managers who discourage reporting is in a strong position.
Discipline for unauthorised work is permitted — but the time must still be paid. Those are separate questions and conflating them is the classic error.
De minimis doctrine has narrowed considerably as time-tracking technology has improved; small increments that are regularly worked and readily recordable are increasingly compensable.
Audit periodically. Compare access logs against time records for a sample period. Finding the gap internally costs far less than finding it in a collective action.