Buddy punching happens when one employee clocks in or out for a coworker who isn’t actually there, in person at a physical time clock, or remotely by sharing a login or PIN in a time tracking app. It’s a form of time theft, and for many employers it’s one of the hardest kinds to catch, because on paper the hours look completely normal.
This guide covers what buddy punching actually costs, the different ways it happens, the warning signs to watch for, how to investigate and respond when you find it, how to prevent it going forward, and what to know before rolling out biometric time clocks, since those come with their own legal requirements.
What Is Buddy Punching?
Buddy punching is when an employee clocks in or out on behalf of a coworker who is not present, so that coworker gets paid for time they didn’t work. The term comes from physical time clocks, where a “buddy” would literally punch a card for another employee, but the same behavior shows up in digital time tracking too.
Common ways it happens
- In person: A coworker swipes a badge, enters a shared PIN, or punches a physical time clock for someone who’s late, absent, or has already left.
- In software: Employees share login credentials so one person clocks in or out for another inside a time tracking app, or someone else enters a coworker’s PIN at a shared kiosk.
- Location spoofing: With remote and field teams, this has evolved into GPS-spoofing apps or VPNs that trick a mobile clock-in app into thinking someone is on-site or inside an approved work zone when they aren’t.
It’s worth separating buddy punching from time theft more broadly. Padding a timesheet, rounding hours in your own favor, or taking longer breaks than logged are all forms of time theft, but they don’t involve a second person. Buddy punching specifically requires collusion, someone else clocking in on your behalf.
What Buddy Punching Actually Costs Employers
Cost figures for buddy punching get repeated a lot online, and not all of them hold up. Several widely cited numbers, including some attributed to the American Payroll Association, could not be traced back to a current, verifiable source, and the dollar amounts vary wildly (from hundreds of millions to hundreds of billions) depending on which site you check. Treat any number you see without a clear source with some skepticism.
Two figures are more traceable:
- Nucleus Research (2005/2009) found that companies eliminating buddy punching through biometric time clocks saved an average of 2.2% of gross payroll. This is an older finding, the original report is no longer publicly hosted, though it’s still widely cited in the industry, but the underlying logic (unverified hours are a direct payroll leak) still holds.
- A 2024 study published in the Journal of Human Resources & Leadership put the average employer loss at $1,560 per employee per year due to buddy punching. For a 50-person company, that’s roughly $78,000 annually in wages paid for time that was never actually worked.
On prevalence, a 2026 survey of over 800 hourly workers by time tracking provider OnTheClock found that 1 in 4 employees admit to buddy punching, either clocking in for a coworker or having one do it for them, and 43% admitted to misreporting or adjusting their own timesheets.
Beyond the direct payroll cost, buddy punching creates knock-on problems: inaccurate labor cost data for scheduling and budgeting, unfair treatment of employees who don’t cut corners, and, if it goes unaddressed, a culture where inflating hours becomes normalized.
Why Employees Buddy Punch in the First Place
Buddy punching is usually framed purely as fraud, and legally that’s accurate, but it’s worth understanding why it happens if you actually want to prevent it rather than just punish it after the fact.
- Covering for a coworker who’s running late. This is the most common scenario by far, one employee clocks the other in “just this once” so they don’t get marked late or lose pay, with no intention of ongoing fraud.
- Weak or nonexistent verification. If the only thing standing between an employee and a punch is a shared PIN or an unlocked kiosk, buddy punching becomes a low-effort favor rather than something that feels like fraud.
- Rigid attendance policies with harsh point systems. When being five minutes late triggers a disciplinary point regardless of the reason, employees have a stronger incentive to help each other avoid the penalty rather than report it honestly.
- Normalized workplace culture. In teams where “punching a friend in” has become routine and unaddressed, new hires often pick up the habit simply because no one has ever pushed back on it.
- Disengagement. In some cases, buddy punching is a symptom of a bigger problem, employees who don’t feel invested in accurate timekeeping because they don’t feel accountable to the team or the employer.
None of this excuses the behavior, but it does change how you prevent it. A harsher point system alone tends to increase the incentive to buddy punch rather than reduce it, since it raises the cost of an honest late arrival. The more effective response usually combines better verification with more reasonable attendance rules.
Warning Signs That Buddy Punching May Be Happening
Buddy punching rarely shows up as an obvious red flag in a report. It’s usually a pattern that only becomes visible once you’re looking for it.
- Punches that don’t match observed reality. An employee’s time record shows them clocked in, but their manager or coworkers didn’t actually see them on-site or online.
- Suspiciously consistent, on-the-dot punches. Real clock-ins tend to be a little irregular, a minute or two of natural variation. Punches that land at exactly the same time every day, especially right at the start of a shift, can indicate the same person (or a script) is doing the punching.
- Clock-ins from an unexpected device or location. Time tracking software with device or IP logging can flag a clock-in that doesn’t match an employee’s usual device, or a geofenced punch that comes from outside the approved radius.
- Absences that don’t line up with payroll. An employee is recorded as absent on a schedule or calendar but still shows full hours on their timesheet for that day.
- Frequent last-minute schedule changes for the same people. Employees who habitually run late but never show a corresponding attendance issue on paper are worth a closer look.
- Punches clustered unusually close together. Multiple employees clocking in within seconds of each other at a shared kiosk, especially when their actual arrival times are known to differ, is a common tell.
Spotting these patterns usually requires cross-referencing time records against something else, a schedule, a manager’s own observation, or device/location data, since the timesheet alone will look clean.
How to Investigate and Respond to a Suspected Case
Finding a possible instance of buddy punching isn’t the same as proving it, and how you handle the investigation matters both for fairness and for any later disciplinary action to hold up.
- Pull the data first. Before talking to anyone, gather the specific punches in question, along with any supporting evidence, device logs, geofence data, photos, badge records, or a manager’s direct observation.
- Look for a pattern, not a single incident. A one-off inconsistency might be a genuine error (a misremembered clock-out, a kiosk glitch). A repeated pattern involving the same two employees is a much stronger signal.
- Talk to both employees separately. Buddy punching involves two people, the one being punched in and the one doing the punching. Interview them individually rather than together, and give each a chance to explain before assuming intent.
- Document everything. Keep a written record of what was found, when, and what each employee said. This matters if the case escalates to termination or, in rare cases, a legal dispute.
- Apply the consequence your policy actually states. This is where having a written policy in advance pays off, enforcement should follow what employees were already told would happen, not be decided case-by-case after the fact.
- Fix the underlying gap. If the investigation reveals a specific loophole (an unmonitored kiosk, a shared PIN, a lack of geofencing for remote punches), close it. Otherwise the same issue tends to resurface with someone else.
Which Industries See the Most Buddy Punching
Buddy punching isn’t evenly distributed. It shows up most in workplaces with high hourly-worker headcounts, shared physical time clocks, and looser day-to-day supervision:
- Retail and hospitality, where large numbers of hourly staff share a small number of clock-in terminals and turnover is high.
- Restaurants and food service, for similar reasons, plus tipped-wage complexity that can make timekeeping errors easier to miss.
- Construction and field services, where crews are spread across job sites and a supervisor can’t always confirm who’s physically present.
- Manufacturing and warehousing, especially on multi-shift operations with shared kiosks at shift-change times.
- Healthcare (non-clinical and support staff), where large shift-based teams and 24/7 coverage create similar conditions to retail and manufacturing.
Office-based, salaried teams see far less of this simply because fewer of them clock in and out at all, buddy punching is fundamentally a problem tied to hourly, shift-based timekeeping.
How to Stop Buddy Punching
No single method eliminates buddy punching on its own, PINs and badges can be shared just as easily as a physical punch card. The most effective setups combine a verification method with a clear policy and consistent enforcement.
Biometric time clocks
Fingerprint scanners, facial recognition, and hand-geometry scanners tie a clock-in to a unique physical trait that can’t be handed off to someone else. This is the strongest technical deterrent, but it comes with real legal requirements, covered below, so it needs to be rolled out carefully.
Photo capture on clock-in
Some time tracking apps take a photo at each clock-in or clock-out, which a manager can review or match automatically. It’s a lighter-weight alternative to biometrics that still confirms who’s actually present.
GPS and geofencing
For field teams, remote staff, or multiple job sites, geofencing restricts clock-in to a defined radius around an approved location. It won’t stop someone from sharing a login, but combined with photo capture or device tracking, it closes off the “clocking in from home while marked as on-site” version of the problem.
PIN codes and ID badges
These are the easiest to implement but the weakest on their own, since a PIN or badge can simply be handed to someone else. They’re worth using as one layer, not the whole solution.
Manager approval workflows
Routing timesheets and punches through a supervisor for review before they reach payroll gives someone a chance to catch anomalies, an employee clocked in who was confirmed absent that day, for example, before they turn into paid hours.
Audit trails and anomaly detection
Modern time tracking software can flag irregular patterns automatically: punches from an unexpected device or location, edits made without explanation, or clock-ins clustered suspiciously close together. For distributed teams especially, this is becoming the standard extra layer on top of geofencing and biometrics.
A clear, enforced policy
Technology only works if there’s a policy behind it. That means:
- Naming buddy punching specifically in the employee handbook, not just a vague “timekeeping accuracy” clause, and defining it as falsification of company records.
- Spelling out consequences in advance, many employers use a tiered approach (written warning, then escalation), though because buddy punching amounts to payroll fraud, some treat any confirmed instance as grounds for immediate termination.
- Introducing the policy during onboarding and reinforcing it periodically, rather than leaving it buried in a handbook no one rereads.
- Training managers to actually watch for patterns, not just rely on the software to catch everything.
- Enforcing the policy consistently across roles and seniority levels, inconsistent enforcement undermines both the deterrent effect and, if it ever leads to a termination dispute, the employer’s legal footing.
Biometric Time Clocks: What to Know Before You Roll One Out
Biometric verification is the most reliable technical fix, but employee biometric data is legally sensitive, and getting this wrong can be expensive.
Illinois’ Biometric Information Privacy Act (BIPA
Illinois’ Biometric Information Privacy Act (BIPA) is the most significant law here. It requires employers to give written notice, get informed written consent before collecting fingerprints or facial geometry, and publish a retention and destruction schedule. Under a 2023 Illinois Supreme Court ruling, each individual scan can count as a separate violation, and statutory damages run $1,000 per negligent violation and $5,000 per intentional or reckless one, which adds up fast on a daily fingerprint clock-in. Fingerprint time clocks are reportedly one of the most common sources of BIPA litigation, usually because employers skip or mishandle the consent step.
Illinois isn’t the only state to be aware of. Texas has its own Capture or Use of Biometric Identifier Act (CUBI), Washington has a Biometric Privacy Act, and California’s CPRA treats biometric data as sensitive personal information with its own set of obligations. More states have similar legislation pending, so it’s worth checking current law before deploying biometric clocks rather than assuming your state is unregulated.
Before rolling out biometric time tracking:
- Check whether your state has a biometric privacy law and what it requires.
- Get written, informed consent from employees before collecting any biometric data.
- Publish a clear retention and destruction policy for that data.
- Talk to employment counsel, particularly if you have employees in Illinois.
How Day Off Can Help
Day Off’s built-in time tracker won’t replace a biometric scanner if that’s the level of verification your business needs, but it closes off a lot of the everyday conditions that let buddy punching go unnoticed in the first place, mainly by keeping attendance, schedules, and leave in one connected system instead of three disconnected ones.
Punch In / Punch Out tied to individual accounts
Employees clock in and out from their own Day Off account rather than a shared physical kiosk or a generic PIN pad. That alone removes the classic “anyone can punch anyone” scenario of a shared time clock, since every punch is tied to a specific login rather than a device sitting in a break room that anyone can walk up to.
Attendance connected to leave and absence records
This is the core of how Day Off helps with buddy punching specifically: attendance isn’t tracked in isolation from time off. If someone is marked absent, on approved leave, or hasn’t requested time off but also hasn’t clocked in, that gap is visible in the same system rather than buried in a separate spreadsheet. Managers can use the +Add Day Off option to reconcile missing punches against actual leave records, which makes it much harder for a “clocked in but not really there” day to slip through unnoticed.
Work schedules employees are measured against
Because Day Off lets you set fixed hours, flexible hours, or rotating shifts for each employee or team, punches are calculated against an actual expected schedule rather than just logged as raw numbers. An employee clocked in during a shift they weren’t scheduled for, or absent during a shift they were, stands out more clearly than it would in a flat, scheduleless time log.
Payroll-ready attendance sheets for manager review
Day Off exports attendance sheets showing clock-in and clock-out times, late time, overtime, absences, and total worked hours. Because these are reviewable before payroll runs, they give managers a natural checkpoint to catch a pattern, like an employee’s hours consistently looking a little too clean, or clock-ins that don’t match a schedule, before it turns into paid wages for time that wasn’t actually worked.
Task and project time logs for extra context
For project-based teams, employees can log tasks alongside their clocked time. This gives managers a second data point beyond a bare punch: hours logged with no associated work, or work claimed without corresponding punched time, are both easier to notice when task data and attendance sit next to each other.
Worth being upfront about: Day Off’s time tracker is login-based rather than biometric, so it doesn’t physically prevent someone from sharing their credentials the way a fingerprint scanner would. What it does well is make the surrounding data, schedules, leave, task logs, and payroll-ready attendance sheets, visible and connected enough that a manager reviewing the numbers has a real shot at catching a mismatch, rather than relying on a flat timesheet that looks fine on its own. If your workforce needs hard biometric or geofenced verification (for example, a multi-site retail or construction operation with a history of buddy punching), that’s worth layering on top as a dedicated clock-in device or app, with Day Off handling the schedule, leave, and payroll side of the picture.
Frequently Asked Questions About Buddy Punching
Can an employer fire someone for buddy punching on the first offense?
In most places, yes, particularly in at-will employment settings. Because buddy punching involves falsifying company records and being paid for hours not worked, many employers classify it as gross misconduct rather than a routine attendance issue, which can justify immediate termination even without a prior written warning. Whether that’s the right call depends on your own policy and how consistently it’s been applied to others.
Should both employees involved be disciplined, or just the one who was absent?
Most HR guidance treats both employees the same way, since the employee doing the punching is knowingly falsifying a record on someone else’s behalf. Disciplining only the absent employee while letting the “helper” off can undermine the policy and create a fairness problem if it happens again.
Does buddy punching count as timesheet fraud for legal purposes?
It can. Buddy punching results in an employer paying wages for hours not actually worked based on a falsified record, which fits the general definition of timesheet or payroll fraud. Whether it rises to a civil or criminal matter depends on the amount involved, your jurisdiction, and whether the employer chooses to pursue it beyond internal discipline, most cases are handled through termination rather than legal action.
Can buddy punching affect unemployment benefits if someone is fired for it?
In many states, a termination for proven timesheet fraud can be classified as termination for cause or misconduct, which can affect a former employee’s eligibility for unemployment benefits. This varies by state, so it’s worth checking local rules rather than assuming.
How long should time clock and punch data be kept as evidence?
Under the Fair Labor Standards Act, US employers are generally required to keep payroll and time records for at least three years, and time cards or schedules that support those records for at least two. Keeping data for at least that long protects you if a disciplinary decision is ever challenged.
Does a time and attendance system need to flag buddy punching automatically, or is manual review enough?
Manual review works for small teams but doesn’t scale, a manager reviewing dozens or hundreds of punches by eye is unlikely to catch a pattern spread across weeks. Automated anomaly detection (flagging device mismatches, geofence violations, or suspiciously identical punch times) is what makes the practice realistically catchable once a company grows past a small team.
Is it buddy punching if a manager clocks an employee in with permission?
Not in the fraudulent sense, but it’s still a compliance risk. If a manager regularly clocks employees in or out on their behalf, even with good intentions, like helping someone who forgot, it creates the same inaccurate, unverifiable record that buddy punching does, and it sets a precedent that’s hard to distinguish from actual buddy punching later. It’s better handled through a formal missed-punch correction process.
Can salaried, exempt employees commit buddy punching?
It’s far less common, since exempt employees typically aren’t paid based on clocked hours. But in workplaces that still require exempt staff to badge in for building access or security purposes, the same “clocking in for someone who isn’t there” behavior can happen, it just doesn’t usually translate into extra pay the way it does for hourly staff.
What’s the difference between buddy punching and a legitimate missed-punch correction?
A missed-punch correction is when an employee forgets to clock in or out and a manager or HR adjusts the record afterward, based on the employee’s own account and typically with some form of approval trail. Buddy punching involves a second person creating the punch in real time on someone else’s behalf, without that person being present at all. The key difference is whether there’s an honest, documented correction process versus an attempt to make an absence look like attendance.
Do time tracking apps notify employers automatically when buddy punching is suspected?
It depends on the software. Basic time clocks just record punches with no analysis. More capable time tracking platforms can flag anomalies, like a device change, a geofence violation, or two punches seconds apart, but this typically has to be enabled and configured; it’s not automatic in every system by default.
Final Thoughts
Buddy punching is easy to underestimate because the hours look normal on a timesheet, the problem only shows up when you compare who actually clocked in against who was actually there. The fix isn’t one tool; it’s pairing a verification method that fits how your team works (photo capture and geofencing for remote or field teams, biometrics for on-site staff where legally appropriate) with a policy that’s actually communicated and enforced, backed by a system that keeps attendance, schedules, and leave connected rather than scattered across separate tools.