It almost never starts as a plan. Someone’s bus is late, they message a colleague who’s already inside, and the colleague types their code or swipes their card. Nobody thinks of it as stealing. Then it happens again, and the time records stop meaning what you think they mean.
What buddy punching is, and why people do it
Buddy punching is any time one person records a clock-in or clock-out on behalf of someone else. The usual reasons are mundane: running late, leaving early for a pick-up, covering for a friend who “will be here in five minutes”. Occasionally it’s deliberate and repeated, but even then it tends to involve the same small group.
The real damage isn’t only the minutes. Once you know it happens, you can no longer trust any of your records, and that matters the day you need them to settle an overtime dispute or to show an inspector what hours people worked.
What it costs, in plain numbers
You’ll find dramatic percentages online about how much payroll is lost to buddy punching. Most of them trace back to surveys that are hard to verify, so I’d rather do the arithmetic with your own numbers:
| Assumption | Value |
|---|---|
| Minutes covered by a colleague per day | 15 |
| Hourly pay | $18 |
| Working days a year | 230 |
| Cost for one employee | 0.25 h × $18 × 230 = $1,035 a year |
Multiply by the number of people involved and add any overtime triggered by hours that weren’t really worked. It’s rarely a fortune, but it’s money for nothing, and the hidden cost is a record you can’t rely on.
The signs in your records
- Clock-ins from the same device within seconds of each other, day after day, by the same two or three people.
- Someone who is often late in person but never late on paper. If your eyes and your records disagree, believe your eyes and look closer.
- Times that don’t match other systems: the till or point-of-sale login, the alarm being switched off, the first delivery signed for, the first email sent.
- Clock-outs at the official time from people you saw leaving earlier.
- A location that doesn’t fit. If location is recorded when clocking in, a clock-in from a home address for someone meant to be on site is worth a conversation.
None of these prove anything on their own. They tell you where to look, and they’re a reason to talk to people before you start changing systems.
Why fingerprint clocks aren’t the easy answer
A fingerprint or face scanner seems to solve the problem at a stroke: you can’t lend someone your finger. The trouble is what you’re collecting. Biometric data is treated as especially sensitive in a growing number of places, and employers have paid for treating it casually.
Illinois
The Illinois Biometric Information Privacy Act (BIPA) requires informed written consent before collecting things like fingerprints or face geometry, and allows damages of $1,000 per negligent violation and $5,000 per intentional or reckless one. In Cothron v. White Castle (2023), the Illinois Supreme Court held that a new claim arises with every scan. White Castle had argued that damages could exceed $17 billion. In 2024 the legislature amended the law (SB 2979) so that repeated scans of the same person count as a single violation, but the consent requirements are unchanged. Texas and Washington have their own biometric privacy laws too.
United Kingdom
In February 2024 the Information Commissioner’s Office issued enforcement notices ordering Serco Leisure and several associated leisure trusts to stop using facial recognition and fingerprint scanning to monitor the attendance of more than 2,000 employees across 38 facilities. The ICO’s point was simple: less intrusive options such as ID cards or fobs were available, and employees hadn’t been offered a real alternative. Under UK GDPR, “it stops buddy punching” wasn’t enough to justify collecting biometric data from everyone.
Ask whether you could reach the same goal without biometric data. If the honest answer is yes, a regulator is likely to reach the same conclusion. In the UK, the EU and several US states, the burden is on you to justify it.
Fixes that work without biometrics
- A personal code for each person, linked to their name. No shared logins, no generic cards hanging on a hook.
- A shared tablet at the entrance, where people can see each other. Clocking in for someone else is much harder when the whole shift is standing in the same spot.
- Location only at the moment of clocking in, and only where it’s justified, such as people who start on client sites. Tell staff what is recorded and why. Tracking people all day is a different thing, and much harder to defend.
- Compare clock-ins with the schedule every day. Patterns show up in a week, not in a quarterly review.
- Corrections with a history. If times can be changed without a trace, buddy punching just moves from the clock to the spreadsheet.
One honest caveat: a code can be shared too. No system stops a determined pair of colleagues on its own. What works is the combination: personal codes, a visible place to clock in, location where it makes sense, and a manager who looks at the daily summary.
Write it down before you need it
Most employers treat clocking in for someone else as misconduct for both people involved. Say so in writing, in your handbook or time-keeping policy, before there’s a problem, so nobody can say they didn’t know. When it does happen, check the records first, talk to the people involved and apply the policy the same way to everyone. Inconsistency is what turns a small disciplinary matter into a grievance.
Clock-ins tied to a name, not to a card on a hook
In CheckInGO each employee has a personal code, the kiosk mode turns a tablet at the entrance into a shared time clock, and location, if you switch it on, is recorded only at the moment of clocking in. Every correction keeps the original time and the reason. $19 a month for up to 10 employees and $2 for each extra one, plus any tax that applies. No contract, and 7 days free to try it with your team.
Try it free for 7 daysFrequently asked questions
Is buddy punching illegal?
In most places it isn’t a specific offence, but employers usually treat it as misconduct, and in serious, deliberate cases it can amount to fraud. What matters in practice is having a written policy and applying it consistently.
Are fingerprint time clocks legal?
They’re legal in many places but heavily regulated. Illinois requires informed written consent under BIPA, and Texas and Washington have their own laws. In the UK and the EU, biometric data is special category data under GDPR, and the ICO has ordered an employer to stop using it for attendance when less intrusive options were available.
Can I use location to stop buddy punching?
Recording location at the moment of clocking in is far easier to justify than tracking employees all day. Use it where there’s a clear reason, such as people who start on client sites, and tell staff what is collected and why.
What should I do if I catch someone clocking in for a colleague?
Check the records and any other evidence first, talk to both people, and then apply your written policy the same way you would for anyone else. If there’s no policy yet, write one and make sure everyone has seen it.
Do personal codes really help if people can share them?
On their own, only partly. Combined with a shared tablet where people clock in in front of each other, location at clock-in where justified and a daily look at the records, they make covering for someone awkward and easy to spot.
Information current as of 27 October 2026. Rules change, and states, provinces and industries often add their own, so use this as a guide rather than legal advice.
← Back to resources