Buddy punching: how it happens and how to stop it

1. What buddy punching is

Buddy punching means a punch recorded for one person was actually made by someone else. The common forms:

• Clocking in early for a late friend. The friend arrives at 8:40, but the record says 8:00.
• Clocking out late for someone who left early. They left at 3:30. Their fob left at 5:00 in a colleague's pocket.
• Covering a whole absence. Someone is clocked in and out for a shift they never worked. Rarer, and closer to outright fraud.
• Shared codes. A team that all know each other's PINs "just in case".

It's one kind of what's often called time theft. Others, like long breaks or padding timesheets by hand, are separate problems with separate fixes.

2. Why it happens

Most people who punch for a friend don't think of it as stealing. They think of it as helping. Understanding why it happens helps you fix the cause, not just the symptom.

• The method allows it. If a fob or a PIN is all it takes, lending one is easy.
• Lateness is punished harshly. If being 5 minutes late costs an hour's pay or a written warning, people will cover for each other.
• Transport is unreliable. When the bus is late every week, colleagues sympathise.
• Nobody checks. If punches are never compared with who's actually on the floor, there's no risk.
• The culture tolerates it. If a supervisor has done it, everyone knows.

The second and third points matter. If your lateness rules are much harsher than the problem, fixing the clock alone will just move the frustration somewhere else.

3. What it costs: a worked example

There's no reliable worldwide figure for how common buddy punching is. Vendor surveys vary widely, and most are marketing. So work it out for your own business instead.

Worked example: 10 minutes a day

You have 20 hourly staff on US$ 10.00 an hour. On average, each one gains 10 unworked minutes a day through covered late arrivals or early exits. There are 22 working days a month.

If those minutes push people into overtime at 1.5×, the same minutes cost US$ 1,100 a month (733.33 × 1.5), or US$ 13,200 a year.

It's usually a few people, not everyone

The average hides the pattern. In practice it's often two or three pairs. One worker who's 45 minutes late twice a week and gets covered each time costs 0.75 × 2 × US$ 10.00 = US$ 15.00 a week, or US$ 780 a year, from one habit.

The money isn't the only cost. Honest staff notice who's never really there at 8:00, and they resent it. Safety suffers too. In an emergency, your roll call says someone is on site when they aren't.

4. Early signs in your time data

Your punch records often show buddy punching before anyone reports it. Look for:

• Pairs that always punch together. Two people who clock in within seconds of each other every day, especially when one of them is often seen arriving later.
• Punches in a burst. Three or four punches on the same device in under a minute, from people who don't arrive together.
• Perfect times. Someone who's never more than a minute late, on a route everyone else complains about.
• Punches that don't match other records. Clocked in at 8:00, but their first sale, delivery or log entry is at 8:45. Clocked out at 5:00, but the gate log or CCTV shows them leaving at 3:30.
• Punches from the wrong place. A phone punch from a location that doesn't match the site they were rostered to.
• Hours that never vary. Real arrival times wobble. A record that never does is worth a look.

None of these prove anything on their own. Buses do sometimes run on time. They tell you where to look, not who to blame.

5. Methods that prevent it

The strongest protection is a clock-in method that checks the person, not just something they carry or know.

Face recognition. The device matches the face to the worker's record. You can't lend your face. It's the most direct fix for shared fobs and PINs. For a full comparison of methods, see the Time clock buying guide.

A photo with every punch. Even without automatic face matching, a photo taken at the moment of the punch changes behaviour. People are far less likely to punch for a friend when their own face will be on the record.

Fob and card limits. Fobs are easy to lend, but you can make it harder. Issue one per person, deactivate lost ones straight away, and pair fobs with a photo or a quick face check on the same device.

Geofencing. For phone-based clock-in, the app only accepts a punch when the phone is inside a zone around the site. It stops someone clocking in from home. It doesn't stop someone handing their phone to a colleague who's already on site, so it works best combined with a photo. See Geofence time tracking.

Proof of place by QR code. A code posted at the site, scanned at the punch. A good system rejects a photo of the code that has already been used, so a picture shared on a group chat won't work twice.

Registered phone number. For clock-in by text or messaging, only accept messages from the number on the worker's record. That stops a friend punching from their own phone, though not someone using the worker's phone.

6. Trade-offs, honestly

Every method has a cost, and not only in money.

Two things to weigh:

• Proportion. A small team where everyone sees everyone may need little more than a supervisor's eye. A large site with shift changes of 100 people needs a method that checks the person.
• Trust. Heavy surveillance can make honest staff feel accused. Explain why you're changing, and apply the same rules to managers.

7. Supervisor checks that still matter

Technology does most of the work, but a few human habits close the gaps.

• A quick head count at the start of a shift, compared with who's clocked in.
• Approving timesheets weekly, not just at payday, while people still remember the week.
• Spot checks of punch photos when something looks off, not as a daily ritual.
• Fixing missed punches properly, with a reason recorded. A system where managers can edit times freely without a log is its own risk.

8. A fair policy

A short written policy protects both sides. It should say:

1. Each person clocks in and out only for themselves. No exceptions, including for supervisors.
2. What to do if you forget or the clock fails. Tell a supervisor the same day, who records the real time and the reason.
3. What counts as late, and what happens. Keep the consequence proportionate. Harsh lateness penalties drive covering.
4. What data the clock collects (photos, face data, location), who can see it, and how long it's kept.
5. What happens if buddy punching is found, for both the person who punched and the person who benefited.

Give it to every worker, explain it at a team meeting, and keep a signed copy where your rules require one.

9. Handling a suspected case

Be careful here. Accusing someone wrongly damages trust far more than the minutes ever cost.

1. Gather the facts first. Punch times, photos, other records. Write down what you found and where.
2. Look for an innocent explanation. A device clock that was wrong. A colleague who tapped the wrong fob by mistake. A system error.
3. Talk to each person privately. Ask what happened before you say what you think happened.
4. Correct the record. Unworked time comes off. If time was worked but recorded wrongly, it should still be paid.
5. Follow your disciplinary process and local law. A first, minor case is often best handled with a warning and a reminder of the policy.
6. Fix the cause. If the method made it easy, change the method.

10. Prevention checklist

• Each site uses a clock-in method that checks the person, or adds a photo at the punch.
• Every worker has their own fob, PIN or login, and nobody shares.
• Lost fobs are deactivated the same day.
• Phone punches are limited to the site, by geofence or QR code.
• Someone reviews a week of punches each month for bursts and pairs.
• Timesheets are approved weekly.
• Manager edits to times are logged with a reason.
• Staff have a written policy, including what data is collected and why.
• Lateness rules are proportionate.
• You've checked the local rules on face data and location.

11. Frequently asked questions