Is Buddy Punching Illegal? What Employers Need to Know

Buddy punching can be illegal, and the legal exposure runs in both directions. For the employee doing it, clocking in for a coworker who is not on the premises is time card fraud: wages paid for time not worked. Most US states treat that as theft of services or obtaining property by false pretenses, a fireable and potentially prosecutable offense. For the employer, the risk is different but just as real: federal law requires accurate records of every hour actually worked, and payroll records distorted by buddy punching create a federal compliance problem that outlasts any individual discipline decision.

What Buddy Punching Is and Why Courts Treat It as Fraud

The buddy punching definition covers any situation where one employee records a clock-in or clock-out entry using a coworker’s credentials while that coworker is not physically present and working. The credentials might be a PIN, a swipe card, a paper timesheet entry, or a mobile app login. The outcome is always the same: a payroll record that says one person worked hours they did not actually work.

Is buddy punching theft? Under most state criminal codes, yes. Buddy punching at work means the absent employee collects wages under false pretenses, and the employee doing the clocking helps make that happen. State statutes classify this variously as theft of services, larceny by fraud, or obtaining property by false pretenses. The dollar threshold for felony versus misdemeanor varies by state, but on the employment side the dollar amount does not determine whether discipline is warranted. Buddy punching fraud is a fireable offense regardless of how many dollars were involved.

Time theft statistics put the scale of the problem in perspective. One industry analysis estimated that buddy punching costs US employers roughly $373 million annually across hourly workforces. That figure reflects the compounding effect of small-time fraud: a few extra minutes per shift, across workers who know no verification layer exists in their employee time tracking system. In businesses without time clock verification, the losses are often invisible until someone reports a coworker or a payroll audit surfaces a pattern.

Buddy punching legal consequences for employees who are caught are significant. Courts and arbitrators consistently uphold terminations for time card fraud, even on a first offense, when the employer can show the conduct was deliberate and the timekeeping policy was clear. A criminal prosecution for a single low-dollar incident is rare, but termination as a buddy punching consequence for employees is routine and legally defensible in every US jurisdiction. A buddy punching write-up documenting the incident, the evidence, and the policy violation creates the paper trail needed for that defense.

What Federal Law Requires on Time Records

Federal wage law under the Fair Labor Standards Act places the recordkeeping burden on employers. Under 29 CFR § 516.2 (Cornell Law), employers covered by the FLSA must maintain accurate records showing hours worked each workday and total hours worked each workweek for every covered employee. The FLSA recordkeeping requirements treat scheduled hours and assumed hours as insufficient: the wage records requirement is for actual hours, not planned hours.

When employees buddy punch, the official time record misrepresents actual hours. That mismatch is a federal compliance failure independent of whatever internal conduct issue it also creates. Paying an employee for buddy-punched time means your FLSA time records do not reflect reality, which weakens your position if the Department of Labor’s Wage and Hour Division ever audits your payroll.

A related rule, 29 CFR § 785.11 (Cornell Law), establishes the “suffered or permitted” standard: work an employer knows about, or reasonably should know about, must be recorded and compensated. Read together, these two provisions of federal wage law mean that employers are responsible for the accuracy of their time data from both directions. Accurate wage records are both a legal requirement and your primary shield against liability in any future wage dispute.

Most business owners think of FLSA time records as an overtime compliance issue. They are also the foundation of your defense in any wage claim. If an employee later sues for unpaid overtime and your records are already distorted by time clock fraud, you cannot demonstrate the accuracy of your data. The same records problem that costs you a few hundred dollars in fraudulent pay today can cost significantly more in a contested wage dispute down the road.

Time and attendance compliance under the FLSA starts with knowing that the person recorded on the clock is the person who actually worked that shift. Payroll accuracy legal obligations do not have a materiality threshold: the requirement is accurate records, period.

What Employer Liability Looks Like After Buddy Punching

Buddy punching consequences for employers fall into three practical categories, each with a different timeline and cost.

The first is direct overpayment loss. Every buddy-punched shift is wages paid for work that was not performed. Recovering that overpayment from an employee is harder than it sounds. State wage payment laws often restrict or prohibit deductions from paychecks for overpayments, even documented ones, without the employee’s written consent. In many states, employers cannot deduct from a final paycheck for a prior overpayment without a signed authorization. The practical result: most overpayments from employee time fraud are written off rather than recovered.

The second is DOL audit exposure. Employer liability for time theft is indirect but lasting. If the Wage and Hour Division investigates a wage complaint at your business and finds payroll records that do not match actual work activity, the inaccuracy extends the inquiry. A business with clean, accurate wage records can isolate a single complaint. A business with records corrupted by payroll fraud involving employees is defending a broader problem. Payroll accuracy legal compliance means your records can withstand scrutiny at any time, not only during a dispute.

The third is downstream overtime calculation errors. Employee time fraud can push recorded hours in either direction. An inflated punch record may show overtime hours that were never worked, creating overpayment. A punch that clocks someone out early on behalf of a coworker may leave real overtime hours unrecorded, creating underpayment liability. Employee time theft legal exposure for employers is not limited to the fraudulent punches themselves; it extends to every wage calculation that depended on the false data.

Can You Fire an Employee for Buddy Punching?

Yes, in most circumstances. Buddy punching termination is legally defensible across nearly all US jurisdictions, and employers who document the violation and apply their policy consistently are well-positioned to act. Here is what shapes the analysis.

The United States operates under at-will employment in 49 of 50 states. Under the at-will doctrine, a private-sector employer may terminate an employee for any legal reason, or for no stated reason at all, as long as the decision is not based on a protected characteristic such as race, sex, religion, national origin, age, or disability. Time theft is a legal reason. At-will employment time theft situations give employers broad latitude to terminate, including on a first offense when the evidence is documented and clear.

Montana is the only state requiring cause for termination after a probationary period ends, under the Wrongful Discharge from Employment Act. Government employees and workers covered by collective bargaining agreements may also have additional protections requiring a formal just-cause process. For private-sector, non-union employees in all other states, the answer to “can you fire someone for buddy punching” is yes, and there is no legal minimum number of warnings required before doing so.

Is time theft illegal under state law? Yes, in the same sense that other property theft is illegal. Time theft laws across the country classify collecting wages through a falsified time record as theft of services or fraud. What makes the employment side of enforcement simpler than a criminal prosecution is the standard of proof: you do not need to prove intent beyond a reasonable doubt. You need to show the violation occurred and that your policy addressed it.

Whether to terminate on a first offense depends on how deliberate the conduct was. An employee who entered a coworker’s PIN without thinking, where intent is genuinely ambiguous, is a different situation from an employee caught on camera clocking in for someone who was not in the building. For documented, deliberate buddy punching fraud, termination is defensible on a first offense. For ambiguous situations, a formal written warning creates the documented record needed to support termination if the violation recurs.

Consistency matters as much as documentation. If you terminate one employee for buddy punching but issue only a warning to another for the same conduct under the same policy, you create the basis for a discrimination claim. Apply your timekeeping policy the same way to every employee, every time.

Disciplinary Options by Offense Type and Severity

Scenario	Recommended Action	Documentation Required
First offense, ambiguous intent (forgot to clock in, coworker helped informally)	Verbal warning, policy re-acknowledgment form	Dated supervisor note in employee file, signed by employee
First offense, clear deliberate fraud (camera, digital clock logs, or badge records confirm it)	Written warning or immediate termination, depending on written policy	Incident report, evidence summary, termination letter if applicable
Second offense, any type	Written final warning or termination	Reference prior warning, new incident report, HR sign-off
Coordinated pattern across multiple employees	Discipline all involved, systemic audit, implement verification technology	Investigation report, individual discipline records, updated policy

How to Build a Timekeeping Policy That Holds Up

A buddy punching policy does not need to be long. It needs to be explicit, signed, and consistently enforced. A defensible clock in clock out policy covers five elements.

State the prohibition directly. The timekeeping policy should say in plain language that employees must only record their own time, that clocking in or out for any other employee is prohibited, and that violations are treated as payroll fraud subject to discipline up to and including termination. Burying this inside a general conduct clause is not the same as addressing it clearly.

Define consequences with flexibility. Using “may result in termination” rather than a rigid multi-step progression gives you the discretion to respond proportionately to the severity of each incident. Time theft discipline should fit the violation. Fixed step-by-step language limits your ability to terminate on a first offense when the fraud is deliberate and well-documented.

Get written acknowledgment. Every employee should sign or electronically acknowledge the employee punch policy when hired and again after any update. Acknowledgment records belong in the personnel file. A warning letter for buddy punching or a termination letter carries more legal weight when the employee’s signature on the policy is already on file before the incident occurred.

Define the investigation process. Before issuing a buddy punching write-up or making a termination decision, your process should require that you review time clock logs, surveillance footage, badge records, or GPS data. Acting on an allegation without verifiable evidence creates wrongful termination exposure even in at-will states. Document what evidence was reviewed and who reviewed it.

Require re-acknowledgment after any warning. When an employee receives a warning for a buddy punching violation, ask them to sign a statement confirming they understand the policy and that recurrence may result in termination. This removes the “I did not know” defense from any future proceeding.

One practical note: this article covers general US employment law principles and FLSA compliance. It is not a substitute for advice from a licensed employment attorney. If you are managing a contested termination, dealing with a union grievance, or operating in a state with specific wage payment restrictions, consult employment counsel before acting.

How Prevention Eliminates the Risk Entirely

Discipline and policy address buddy punching after wages have already been lost and FLSA records have already been corrupted. The more durable approach is to prevent buddy punching before the first fraudulent punch occurs. Three technology controls make it structurally impossible rather than merely prohibited.

A photo time clock captures an image of the employee at the exact moment of clock-in. The photo is stored with the time entry, creating a visible, time-stamped record of who was actually at the device. Time clock verification becomes immediate: if the face in the photo does not match the employee on the clock, the discrepancy is visible before the shift ends. Kloqk’s buddy punching prevention feature includes webcam photo capture built into the free kiosk plan, so every punch comes with a face-linked timestamp without purchasing dedicated hardware or biometric equipment.

A biometric time clock uses a fingerprint, palm vein, or facial scan that is unique to each employee. Because the biological trait cannot be shared or delegated, buddy punching is physically impossible rather than just against policy. Biometric time clock hardware carries a higher upfront cost, and several states (Illinois, Texas, Washington) impose separate consent requirements and data handling obligations under biometric privacy laws. For high-turnover environments where buddy punching risk is elevated, biometrics remain the most airtight identity verification option.

A GPS time clock requires employees to punch in from within a defined geographic boundary around the work location. For mobile workers and field crews, GPS time clock enforcement confirms location alongside identity. If the employee is not at the job site when they punch, the clock-in is rejected. This directly supports overtime law compliance by ensuring that every hour in the record corresponds to a verified, location-confirmed shift, not a punch made from a couch three miles away.

The return on verified employee time tracking is direct: every minute on the clock reflects actual time worked, your federal wage records are accurate, and you remove both the payroll cost and the legal exposure that buddy punching creates. You also eliminate the uncomfortable situation where honest employees feel pressured to cover for a coworker, or have to weigh loyalty against reporting a policy violation. When the system verifies identity automatically, no one is put in that position. That is how to stop buddy punching for good: remove the opportunity rather than relying on enforcement after the fact.

Frequently Asked Questions

Is buddy punching considered theft?

Yes, under most state criminal codes. When one employee clocks in for a coworker who is not present, the absent employee collects wages for time not worked. Most states classify this as theft of services, larceny by fraud, or obtaining property by false pretenses. Prosecution over a small dollar amount is uncommon, but on the employment side there is no minimum dollar threshold: buddy punching is grounds for discipline or termination regardless of the amount involved.

Can an employer be penalized for inaccurate time records caused by buddy punching?

Yes. Under 29 CFR § 516.2, the FLSA requires employers to maintain accurate records of hours actually worked each workday and workweek. When buddy punching distorts those records, the employer is out of compliance regardless of whether the fraud was the employer's fault. If the Department of Labor audits your payroll and finds records that do not match actual work activity, the employer bears the burden of explanation and may face civil liability for any resulting wage errors.

Do you need a written policy to fire someone for buddy punching?

Not legally, but it dramatically strengthens your position. In at-will states, you can terminate for buddy punching without a written policy, but a termination is harder to defend if the employee challenges it and no explicit written rule existed. A timekeeping policy that prohibits buddy punching, combined with a signed acknowledgment from the employee, makes any subsequent termination nearly airtight and removes the "I did not know" defense.

What is the fastest way to stop buddy punching?

Require photo verification at every clock-in. A photo time clock captures an image of the employee at the moment of punch, making it impossible to clock in for a coworker without being identified in the audit record. Kloqk includes webcam photo capture in its free kiosk mode, so every punch comes with a face-linked timestamp without purchasing hardware or upgrading to a paid plan.

Can buddy punching happen on mobile time tracking apps?

Yes, if the app relies only on a PIN or password. An employee can share login credentials on a phone just as easily as on a PIN pad. GPS geofencing adds a location requirement that limits remote fraud, and photo capture at punch adds identity verification. Both controls are available in Kloqk’s mobile punch feature: GPS on Premium and photo capture built into the free kiosk mode.