How to Stop Buddy Punching in Your Small Business

To stop buddy punching, do three things together: write a policy that names it and states the consequence, switch to a clock-in that proves who is standing at the punch, and review the data every week so patterns show up early. Any one of these alone leaves a gap. All three together make it hard, and a little awkward, for one person to clock in for another.

Buddy punching means an employee clocks in or out for a coworker so the coworker is paid for time they did not work. AIHR describes it as a form of time theft. It usually starts small, a friend running late or a favor on a slow Friday. It becomes a habit because nothing in the old system noticed.

TL;DR

• Write a one-page policy that names buddy punching, says it is prohibited and states what happens, then get a signed acknowledgment.
• Replace shared PINs and paper sheets with a clock-in tied to one person: personal login, photo at punch, and location checks for off-site crews.
• Review exceptions weekly: identical punch times, punches far from the job site, and edits after the fact.
• Never fix a suspected case by docking pay. Pay for hours worked and handle the conduct through discipline.
• Keep accurate hour records. Federal law requires them whether or not anyone cheats.

Table of Contents

• Why buddy punching happens and why it lasts
• Step 1: Put a clear buddy punching policy in writing
• Step 2: Use a clock-in that verifies the person
• Step 3: Build location rules for the way you work
• Step 4: Review exceptions every week
• Step 5: Handle a confirmed case by the book
• The recordkeeping rules that apply either way
• What this looks like in Kloqk
• Our perspective
• FAQ
• Sources

Why buddy punching happens and why it lasts

Most buddy punching is not a scheme. It is opportunity plus a weak system. A shared kiosk with a four-digit code, a paper sheet by the door or a manager who types in times from memory all let one person act for two.

Three conditions tend to be present:

• Anyone can punch for anyone. A code that coworkers know, or a card that can be handed over, proves nothing about who is there.
• Nobody looks at the data. If punches are never compared to schedules or locations, a pattern can run for months.
• The rule is unwritten. Employees who never signed a policy can say they did not know it was a problem.

Fix those three and the behavior mostly stops. You do not need to treat your team as suspects to do it. A system that makes the honest way the easy way protects honest employees too, because it keeps a colleague’s cheating out of your labor costs and out of the schedule fights that follow.

Step 1: Put a clear buddy punching policy in writing

Start with the cheapest control. FirstHR recommends defining time theft, explicitly prohibiting buddy punching, stating the consequences and collecting a signed acknowledgment that each employee read and understood the policy.

Keep it to one page. A workable version covers:

1. Definition. Clocking in or out for anyone else, or asking anyone to do it for you, is prohibited.
2. Scope. It applies to the person who punches and the person who benefits.
3. Consequence. Say what follows a first and a repeat offense, such as a written warning and termination. Apply it the same way to everyone.
4. Method. Explain how each person clocks in, and that punches are tied to individual accounts.
5. Corrections. Say how to report a missed punch, so honest mistakes have a clear path.

Cover it in onboarding and repeat it when you change systems. If you want the legal side in plain terms, we cover it in is buddy punching illegal.

Step 2: Use a clock-in that verifies the person

The direct counter to buddy punching is a timekeeping control that confirms the actual worker behind the punch. The options differ in cost, privacy exposure and fit.

For most small businesses, photo verification plus location checks cover the realistic risk without the legal weight of collecting fingerprints or face templates. The photo is a record a manager can look at. If a face does not match the account, the question answers itself.

A note on biometrics

Fingerprint and face-scan clocks are effective, but they carry legal obligations. Illinois’ Biometric Information Privacy Act lets a person sue and recover $1,000 per negligent violation and $5,000 per intentional or reckless one, plus attorney fees. If you operate in Illinois, or collect biometric data in any state with a similar law, talk to an employment attorney before you buy the hardware. A photo-and-location approach avoids most of that question.

Location tracking has its own rule in places like New York, where Labor Law Section 203-c is described as requiring written notice before electronic monitoring. Put the notice in your policy and get it acknowledged before anyone uses the system.

Step 3: Build location rules for the way you work

A control that suits a diner does not suit a roofing crew. Match the method to the floor or the field.

Restaurants

Shift change is the risk point. A line cook arrives and a friend punches in from the parking lot or from home. A photo at the punch plus a personal login at the kiosk makes that visible. Add a weekly look at clock-ins that land exactly at shift start, and at early punches that do not match the schedule. Our guide to time theft prevention goes deeper on restaurant patterns.

Construction and field crews

The supervisor is often on another site, so nobody is watching the trailer. Geofencing helps because a punch only counts when the phone is at the job site. A foreman cannot clock in a whole crew from the truck two miles away. Pair it with photos, and the daily record also settles disputes about who was where. See how job-site clock-ins prevent disputes, and our GPS time clock page for setup.

Retail

Stores run on short shifts, part-timers and open-and-close handoffs. Use a kiosk or tablet at the back office with photo capture, and let managers approve any manual change. Because retail schedules shift week to week, compare punches to the posted schedule rather than to memory.

Clinics

Clinics often have mixed pay rules, with some staff hourly and some salaried, and a lot of coverage swapping. Use individual logins and photo verification, and require that any shift swap is entered in the system rather than handled between staff. Salary status matters for overtime, which we explain in can salary workers get overtime.

Step 4: Review exceptions every week

Technology only works if someone looks. Ten minutes a week is enough. Check:

• Matching punch times. Two employees clocking in within the same few seconds, repeatedly, from the same device.
• Photo mismatches. A face that does not fit the account.
• Out-of-area punches. A punch outside the job-site radius, or a punch with no location at all.
• Edits. Who changed a time, when, and why.
• Patterns around one person. Someone who always clocks in before a particular coworker arrives.

A flag is a reason to ask a question, not proof. Talk to the employee, look at the record, and decide from facts. Our article on common time fraud tactics lists other patterns to watch beyond buddy punching.

Step 5: Handle a confirmed case by the book

The legal trap is in the response. FirstHR notes that under the FLSA employers must pay for hours actually worked and generally cannot withhold earned wages as punishment or to recover suspected time theft. Withholding can itself become wage theft.

So separate the two issues:

1. Pay what was worked. The employee who did the work gets paid for those hours.
2. Correct the false time. Remove the hours that were not worked from the absent coworker’s record, with documentation.
3. Discipline the conduct. Apply the consequence in your written policy, equally to both people.
4. Document. Keep the photos, punch log and notes of the conversation.

Watch rounding too. Federal rounding rules under 29 CFR 785.48(b) allow certain intervals only if employees are still paid for all hours worked. Rounding that always favors the employer is a wage violation, so do not use it as a time theft control.

The recordkeeping rules that apply either way

You need accurate time records whether or not you ever catch buddy punching. The Department of Labor’s recordkeeping fact sheet says covered employers must keep records for each non-exempt worker, including hours worked and wages earned, and that the information must be accurate. The Act does not require a particular form.

Overtime is where bad records cost the most. Under the FLSA, non-exempt employees must receive overtime at 1.5 times the regular rate for hours beyond 40 in a workweek, according to LegalClarity’s summary, which also notes the fixed 168-hour workweek and the retention periods in 29 CFR 516.5. A phantom punch can push someone else’s weekly total over 40 and create overtime you did not intend to pay. Our FLSA overtime rules guide and the explainer on how many hours a week before overtime walk through it. State rules can be stricter, which is why daily overtime and break rules matter in some states.

Good records also protect you if a wage claim arrives. If you want to understand why this matters for owners, why business records matter legally covers the California side of keeping documentation in order.

What this looks like in Kloqk

We built Kloqk so a small team can close the gaps above without paying for the basics. The free plan is designed to cover payroll-ready timesheets, overtime and break calculations, photo verification at clock-in, team management dashboards, payroll exports, and mobile and kiosk punching. Compliance with federal and state labor rules is built into how hours are calculated.

If your crews work off-site, the GPS time clock with geofencing ties each punch to a place. If you want to see how hours become overtime, the overtime tracking software page shows break rules by state.

Optional upgrades add scheduling, PTO and hiring tools. Published plans are Pro at $29 per month per location and Premium at $59 per month per location, and the Free plan has no published price. Compare them on the pricing page, or start with the free time clock software.

Setting it up takes the same effort as writing the policy: add your employees, choose photo verification, and share the clock-in link or kiosk. Then run your first weekly review.

Our perspective

Most owners tell us the same thing: they did not start a business to police punch times. They want hours they can trust, so payroll takes minutes instead of an evening.

We think the fix should not cost extra. Photo verification, overtime and break calculations, and payroll exports are the basics of an honest time clock, which is why we offer them in a free plan with unlimited employees.

Our view is simple: make the right punch the easy punch. When every clock-in is tied to one person, one photo and one place, most buddy punching stops before anyone has to confront anyone. Upgrades are there when you need scheduling or PTO, but you should never need a paid plan just to know who was at work.

Saad

FAQ

Is buddy punching illegal?

It is falsification of time records, and it can lead to termination and, in some situations, legal exposure for the employee, and recordkeeping problems for the employer. The details depend on the state and facts. Our article on whether buddy punching is illegal explains what employers need to know.

Can I dock pay to recover buddy punching losses?

Generally no. Employees must be paid for hours they actually worked, and withholding earned wages as punishment can itself be wage theft. Correct the false hours, discipline through your policy, and talk to an employment attorney or your state labor agency before changing pay in any dispute.

What is the cheapest way to stop buddy punching?

A written policy with signed acknowledgments costs nothing, and pairing it with a time clock that captures a photo at each punch adds real verification. Kloqk’s free plan includes photo verification and payroll-ready timesheets.

Do I need fingerprint scanners?

No. Biometric scanners work, but they bring privacy obligations, such as Illinois’ BIPA, and hardware costs. Many small employers use personal logins, photos and location checks instead.

Sources

• What Is Buddy Punching? AIHR
• Time Theft at Work: What It Is and How to Prevent It, FirstHR
• Fact Sheet #21: Recordkeeping Requirements under the FLSA, U.S. Department of Labor
• BIPA Explained: Illinois Biometric Privacy Act
• Employee Time Tracking Policy: 10 Must-Haves
• How to Have Employees Clock In and Out: Rules and Penalties, LegalClarity

Recommended

• What Is Buddy Punching? Costs and How to Stop It
• Is Buddy Punching Illegal? What Employers Need to Know
• How to Prevent Buddy Punching Free Photo & GPS Time Clock