Buddy Punching Statistics 2026: Time and Attendance Fraud

Buddy punching, when one employee clocks in or out for another, is the most common form of time and attendance fraud in US workplaces. Roughly 75% of employers lose money to it, and industry estimates put the direct cost near $373 million a year. Every statistic on this page is tied to a source we loaded and verified.

Use these numbers to size the problem for your own team, or cite them in your own writing. Researchers and writers are welcome to quote any figure here; a link back to this page is appreciated but not required.

Buddy punching statistics and time theft costs at a glance

These are the figures that get quoted in payroll meetings. The table lists each number, what it measures, and the source where we confirmed it.

Statistic	Figure	Source
US businesses affected by buddy punching	~75%	American Payroll Association, via OnTheClock
Annual cost of buddy punching to US employers	$373 million	Industry estimate, via OnTheClock
Buddy punching as a share of gross payroll	Up to 2.2%	APA estimate, via Hubstaff
Estimated buddy punching loss per employee	~$1,560 per year	Hubstaff
Time lost to time theft per employee	~4.5 hours per week	Robert Half, via OnTheClock
Total US time theft, all forms	~$50 billion per year	Statistics Brain, via OnTheClock
Back wages recovered by federal enforcement, FY2024	$202.7 million for 151,989 workers	DOL WHD data, via WorldatWork

One honest caveat. The 75% and $373 million figures trace back to American Payroll Association research that the APA no longer hosts publicly, so we link the accessible industry pages where the numbers appear today. Treat them as the payroll industry's standard estimates rather than fresh survey data. The Department of Labor figures, by contrast, come straight from federal enforcement records.

How common is buddy punching, really?

Common enough that it's the rule, not the exception. If three quarters of employers lose money to it, and your team punches on paper timesheets, a spreadsheet, or a shared tablet with nothing but a PIN, the safe assumption is that it's happening to you.

The mechanism is social, not criminal. A coworker is stuck in traffic and texts a friend on shift. The friend taps a punch. Four minutes here, ten minutes there. Punching time clock entries for a friend feels like a favor, not fraud, which is exactly why it persists. Nobody involved would call it stealing, and no single incident is big enough to notice on a timesheet.

Robert Half's research puts overall time theft, of which buddy punching is one flavor, at about 4.5 hours per employee per week. Even if your team is far more honest than that average, a fraction of it still swamps most other payroll leaks.

It concentrates wherever supervision is thin and schedules are variable:

• Restaurants, cafes, and bars, where rushes make oversight impossible
• Retail floors with staggered openers and closers
• Construction sites and field crews spread across locations
• Warehouses and logistics operations running multiple shifts
• Healthcare support staff and home care teams
• Cleaning and security services working off-site and unsupervised

The common thread is hourly pay plus limited line of sight. Old wall-mounted time clocks were built for a world where a supervisor stood next to them. Most small businesses don't have that world anymore.

Which industries lose the most to buddy punching?

Restaurants and hospitality top most lists, and the reasons are structural. Turnover is high, so a chunk of the roster is always new and loosely attached. Margins are thin, so a few padded minutes per server per shift is real money against food-service economics. And during a Friday rush, no manager on earth is watching the punch tablet. The Department of Labor's food service enforcement numbers show how much wage-and-hour attention the industry already gets, which makes sloppy punch records doubly risky there.

Construction and field trades come next. Crews scatter across job sites, start times drift with weather and deliveries, and the person tracking hours is often a foreman with nine other jobs. Without location data on the punch, "I was at the site at 7" is unverifiable either way.

Retail and warehousing share a different weakness: staggered shifts. Openers, closers, and overlapping part-timers mean the manager on duty rarely knows exactly who is supposed to be on the clock at any moment. Healthcare support and home care add solo, off-site work, where the honor system is the whole system unless the punch carries GPS.

If your business is on that list, the base rates above probably understate your exposure. If it isn't, don't relax too much. The 75% figure covers every industry, including offices.

Buddy punching is only one form of time theft

The $50 billion time theft estimate covers a family of behaviors, and buddy punching is just the most visible member. The same timesheet usually carries several of them at once:

• Punch padding. Clocking in ten minutes before actually starting, or lingering after the work is done.
• Extended breaks. A 30-minute lunch that runs 45, logged as 30.
• Ghost overtime. Staying on the clock past the end of a shift without any remaining work.
• Manual timesheet rounding. "I got in around 8" written down as 8:00 every day, always in the same direction.

How much does time theft cost employers?

The widest figure on this page, roughly $50 billion a year across the US, covers every behavior in that list rather than buddy punching alone. Time theft statistics at national scale are directional, not precise, and any single number is best read as an order of magnitude. What holds up across sources is the shape of the cost: small per incident, constant, and invisible on a P&L. Employee time theft never appears as a line item you can cut, which is why it survives every budget review.

This matters for how you fix it. A control that only targets buddy punching, like requiring a manager to witness punches, leaves the rest of the leak open. Punch-level verification (a face, a place, a timestamp, an edit log) closes the whole family at once, because every entry becomes evidence instead of an honor-system claim.

How much does buddy punching cost a small business?

The national statistics are useful for scale, but the number that matters is yours. The math takes two minutes.

Take a 20-person crew at $15 an hour, five shifts a week each. If padded punches add just four minutes per shift, that's 20 minutes per employee per week. Across the whole team, that is roughly 6.7 unearned hours a week, about $100 in wages. Run it for a year and you've paid around $5,200 for work nobody did. Push the padding to ten minutes a shift and the bill hits $13,000.

The 2.2%-of-gross-payroll estimate points the same direction from a different angle. On a $500,000 annual hourly payroll, 2.2% is $11,000 gone before you count a single overtime premium. These are models, not measurements, so plug in your real headcount and wages. Our free time card calculator makes the per-employee math quick.

What makes this leak unusual is that it compounds silently. It never appears as a line item, it survives budget reviews, and it grows with every hire. A $5,200 annual loss at 20 employees becomes $13,000 at 50 without anyone changing their behavior.

Padded hours get pricier after 40: the time and a half effect

Straight wages are only the floor of the loss. Under federal law, hours over 40 in a workweek must be paid at not less than one and one-half times the regular rate (29 USC 207). Time and a half turns a $15 padded hour into a $22.50 padded hour.

This bites hardest in exactly the weeks when buddy punching is easiest: busy ones. During a holiday rush or a short-staffed stretch, employees are already near 40 hours, supervision is stretched thin, and a friend covering a punch pushes recorded time into overtime territory. The fraudulent minutes land at the premium rate. If you want to see what a few phantom overtime hours cost at your wages, run them through the overtime calculator.

Your time records are legal documents

Here's the part of the buddy punching problem that isn't about the money you lose directly. Federal recordkeeping rules require employers to keep, for each nonexempt employee, the hours worked each workday and the total hours worked each workweek (29 CFR 516.2), and to preserve those payroll records for at least three years (29 CFR 516.5).

A timecard that says an absent employee was on the clock is not just a leak. It's an inaccurate legal record. In a wage dispute, unreliable employer records tend to help the employee, because courts generally accept a worker's reasonable estimate of hours when the employer's own records can't be trusted. You end up paying twice: once for the padded punches, and again when your records can't defend you.

Enforcement is not hypothetical. The Department of Labor's Wage and Hour Division recovered $202.7 million in back wages for 151,989 workers in fiscal year 2024 alone. Small businesses are regular targets of those investigations, and clean punch records are the difference between a quick file review and a painful one. Our state-by-state overtime law guide covers where the rules get stricter than the federal floor.

Is buddy punching illegal?

No federal statute names it. What exists is broader: employee time theft is handled as theft or fraud under state law, and an employee who punches for an absent coworker is claiming wages nobody earned. Whether a prosecutor would ever take a case over eleven minutes is a separate question from whether you can fire someone over it. You can, and most handbooks already cover it under falsifying company records.

Your own exposure runs the other direction. Federal time and attendance requirements make the employer responsible for accurate hours worked, not the employee (29 CFR 516.2). A record showing an absent person on the clock is your inaccurate record, and you are the one who has to defend it. That is why the fix belongs in the punch method rather than in a disciplinary process. You cannot discipline your way to accurate records, and time and attendance rules that live only in a handbook produce no evidence.

Write the policy anyway. One line stating that punching for another employee is grounds for termination, acknowledged in writing at hire, removes any later argument about whether people knew. Put it in the same attendance policy that covers lateness and call-outs. Pair it with a punch method that makes the act visible and you will almost never need to use it.

How do you stop buddy punching?

Three controls remove nearly all of it. None of them require new hardware.

• A photo at every punch. The kiosk snaps a webcam picture when someone clocks in, so every punch is tied to a face. Ghost punches become obvious in seconds.
• GPS geofencing for mobile punches. Off-site and field crews punch from their own phones, and the punch only counts inside the job site's geofence. A friend at home can't clock in from the couch.
• An audit log on every timecard edit. When a manager fixes a punch, the change and the editor are recorded. Quiet timecard grooming stops when edits leave fingerprints.

Here's how the common punch methods stack up against buddy punching risk:

Punch method	Buddy punching risk	Why
Paper attendance sheet or a shared spreadsheet	Very high	Anyone can write anything, and nobody can prove otherwise
Mechanical punch clock with time cards	High	A time card doesn't know who fed it into the machine
Shared tablet kiosk, PIN only	High	PINs get shared in the first week
Kiosk with photo at punch	Low	Every punch has a face attached
Mobile punch with GPS geofence	Low	Punch is tied to the employee's phone and the work location
Biometric clock (fingerprint or face)	Very low	Hard to fake, but biometric privacy laws in states like Illinois and Texas add consent and storage obligations, plus hardware cost

Biometrics work, but for most small teams they're more machine than the problem needs. A photo at punch on the tablet you already own, plus GPS for anyone working off-site, gets you the same practical result with no special hardware and far less legal overhead. That combination is exactly what Kloqk's tools to prevent buddy punching do: the time clock with photo attaches a snapshot to every kiosk punch on the free plan, and the GPS time clock keeps mobile punches inside your geofence on the Premium plan at $6 per user.

The goal isn't to police honest people. It's to remove the easy, low-guilt opportunity. Once a punch carries a face and a location, the "can you clock me in?" text simply stops getting sent, and your honest employees notice nothing at all, because they were already punching their real hours.

You do not need enterprise software for this. Most time and attendance programs sold to small businesses now include photo capture somewhere in the plan list, and the only real question is which tier holds it. No time & attendance system is immune to buddy punching by default, so treat the photo setting as the feature you are shopping for. Free time and attendance software with the photo feature in the free layer exists, so check for that before you price a biometric terminal. The best time and attendance choice for this specific problem is whichever tool your crew will actually use at 6am with no manager standing there, and time and attendance for small business succeeds or fails on that rather than on the feature grid.

How does a photo time clock work?

A time clock with photo capture uses the camera already in the tablet or the phone. When someone taps to clock in, the app takes one still image at the moment of the punch and stores it with the time entry. Nobody watches a video feed. One photo, one timestamp, visible to whoever reviews timesheets.

That is enough, because the fraud depends on nobody being able to check. A manager scanning a day of thumbnails spots the same face punching twice in ten seconds, or a face that does not match the PIN. Most owners look closely for the first two weeks and rarely after that, because by then the texts asking for a favor have stopped.

Time and attendance for employees should feel identical afterward: same tap, same three seconds, same screen. Tell the team before you switch it on. A photo at punch reads as surveillance when it appears with no warning and as normal within a week when you explain it in one sentence, that the camera confirms who punched and does not watch anyone work.

Any attendance tracker can record a number. The question is whether the number counts as evidence. Attendance tracking without identity verification is a spreadsheet with better fonts, so an attendance application that attaches a face or a location to each entry is worth more than one with a longer feature list. For crews who never pass a fixed screen, a time and attendance app on their own phones does the same job with GPS instead of a camera. The shared PIN pad, the classic buddy punch time clock, is the setup both of them replace.

How to measure it on your own team

Don't take the national averages on faith. Test them against your own payroll in under an hour:

1. Pull the last two weeks of punch data for your hourly team.
2. Compare punched hours against scheduled hours, shift by shift. Flag every punch that starts early or ends late by more than a couple of minutes.
3. Add up the gap minutes and multiply by each person's wage. That's your two-week leak; multiply by 26 for the annual number.
4. Check which flagged punches happened when no manager was present. Those are your buddy punching candidates.
5. Turn on photo punches for two pay periods and rerun the numbers. The before-and-after difference is your answer.

Most owners who run this exercise find a number between the optimistic case and the 2.2% industry estimate. Whatever yours turns out to be, it repeats every pay period until the punch method changes. Fix the punch, not the people.