What Is Buddy Punching? Costs and How to Stop It

Buddy punching is when one employee clocks in or out on behalf of a coworker who is not physically present. The buddy doing the punching is at work; the person being clocked in or out is not. It is one of the most common forms of employee time theft, and it costs US employers hundreds of millions of dollars each year in wages paid for hours never worked.

What Buddy Punching Looks Like in Practice

The buddy punching meaning is straightforward: one employee authenticates the time clock on behalf of another. The mechanics depend on the type of time and attendance system your team uses, and every common setup has a version of the same vulnerability.

PIN-based terminals. A digital time clock that accepts a personal identification number is only as secure as the privacy of that PIN. An employee shares their number with a coworker. The coworker walks up to the terminal, enters it, and the system records a valid punch for someone who is not there. PIN sharing is the most common form of buddy clocking because there is nothing physical to hand over and no trace left afterward. A quick text with a four-digit number is all it takes, and the sender can be miles away.

Physical punch cards. Traditional card rack systems perform no identity check. Any employee can pull a colleague's card from the slot, run it through the reader, and return it. The machine records a timestamp, the card goes back in the rack, and the entry looks entirely legitimate. This form of proxy punching is the oldest version of time clock fraud, but it persists wherever paper-based systems remain in use.

Badge and RFID swipes. Access badges are convenient but easy to transfer. A coworker already on site can tap or swipe a badge for a colleague who has not yet arrived. The system reads the credential as valid because it is valid. The absent employee's name appears in the record as present. Ghost punching through a badge swipe is particularly hard to catch without a camera at the punch station, because a clean credential scan raises no flags in the data.

Mobile clock-in apps. A phone-based punch clock app tied to a personal device can seem more secure. Without GPS geofencing or photo verification, though, handing a phone to a coworker for 10 seconds is enough. The app records the punch under the phone owner's account. If the coworker happens to be at the job site, the location may even look correct. The absent employee appears as clocked in with no visible anomaly in the data.

Buddy punching examples follow the same pattern across every industry. A line cook texts a coworker already on shift: I'm running 20 minutes behind, can you punch me in? The coworker does. Payroll pays for 20 minutes not worked. At a retail store, two employees clock each other out on the way to the parking lot, each gaining a few extra minutes per week. At a dental office, a front desk employee uses a colleague's PIN after a quick call explaining they are running late, and the colleague's attendance record shows no tardiness at all. The details differ; the mechanism is identical.

All of these share the same structural problem: the time clock verified a credential rather than a person. Buddy punching, ghost punching, and proxy punching are all names for the same gap between what the system checks and who is actually standing there.

Why Buddy Punching Is More Common Than Most Owners Expect

A 2017 survey of 1,000 employees found that 16 percent admitted to clocking in for a colleague. That is roughly one in six hourly workers. In a restaurant with 30 employees, that figure suggests five people have done it at some point. In a retail store with 15 part-timers, two or three have likely done it.

The reason it is so persistent is that most buddy punching is not calculated payroll fraud. It is a social favor between people who work side by side every day. Someone is stuck in traffic, overslept, or had an emergency on the way in. A coworker covers them the same way they might take a message or handle a customer. The intent is loyalty to a friend, not theft from the business, and that framing is what makes the practice so easy to normalize and so difficult to address after the fact.

An employee who has punched in for a friend does not feel like someone who committed time clock fraud. A manager who catches it faces a conversation that feels wildly disproportionate to a 20-minute favor between two otherwise solid employees. The conversation gets delayed, the behavior goes unaddressed, and the accumulated cost grows in silence over months or years.

The data invisibility problem makes it worse. A PIN-based or card-based time and attendance system records every buddy punch as a valid transaction. There is no error message, no anomaly flag, and nothing in the hourly employee tracking data to indicate the person who authenticated was different from the person whose record was updated. Detection requires direct observation or a tip from another employee, and neither approach scales for a business with 10 to 30 people.

The practice is especially common in industries where close-knit hourly teams are the norm: restaurants, retail stores, hotels, warehouses, auto shops, construction crews, and medical offices. These are environments where employees cover for each other constantly and where informal social contracts around helping out extend naturally to clocking in for a friend running behind. The same workplace culture that makes a team effective creates the conditions for employee time fraud to feel like no big deal.

Variable schedules and split shifts compound the problem. When employees work different hours across locations, the probability of a manager being physically present at every punch drops significantly. Employees who would not attempt buddy clocking under direct supervision will do it when no one is watching the terminal, which for most small businesses is most of the time.

How Much Does Buddy Punching Cost Your Business?

The national figure is significant. Research cited by HR Daily Advisor calculated that if 16 percent of the roughly 78 million hourly US workers each added just 15 minutes to a colleague's timesheet once, the aggregate cost to employers would exceed $373 million in a single year. That is a conservative floor based on one incident per person. Employees who buddy punch regularly, or who add more than 15 minutes, push the actual total considerably higher.

The per-business calculation is the number worth working out for your own situation.

At 15 minutes per week per employee, a team of 10 costs $1,950 in overpaid wages annually. Scale to 20 employees and the number reaches $3,900. At 50 employees it is $9,750. These figures assume a $15 hourly wage; at $17 or $20 per hour, every total climbs proportionally, and the gap between what you think labor costs and what it actually costs widens further.

The hidden layer is payroll taxes. Every dollar of overpaid wages also increases your employer share of FICA taxes by 7.65 percent. A $1,950 overpayment in wages actually costs closer to $2,099 once the Social Security and Medicare contributions triggered by those wages are included. That extra cost does not appear as a separate line in most payroll reports, so it is easy to miss entirely.

The 15-minutes-per-week assumption is conservative. The same research that surfaced the 16 percent participation rate found the most common time added per incident was 15 minutes. An employee who buddy punches twice in a week is already at 30 minutes. Buddy-outs at end of shift, where a coworker clocks someone out after they have already left for the day, add a second layer that most employers track even less carefully than clock-ins.

The indirect cost compounds the direct one. Payroll accuracy drives every downstream labor report you produce. When your time and attendance data shows employees clocking in on time while they were actually 20 to 40 minutes late, your effective labor cost per shift is understated. Staffing models, overtime analysis, and schedule decisions all inherit the same inaccuracy, and managers building on that data are working from a floor that does not reflect what actually happened.

Is Buddy Punching Illegal?

Buddy punching is not a grey area legally, though where the exposure falls depends on which side of the employment relationship you are examining.

For the employee doing the punching: clocking in or out on behalf of someone else is falsifying a business record. Both the employee who makes the punch and the employee who requested it are participating in employee time fraud. Depending on the total amount overpaid and state law, consequences range from termination for cause to civil recovery of wages and, in cases involving repeated incidents or large aggregate amounts, criminal charges for theft or payroll fraud. Most employers do not pursue criminal charges for a single incident, but the legal basis exists and should be documented.

For the employer: 29 CFR 516.2 under the Fair Labor Standards Act requires employers to maintain accurate records of hours worked each workday and total hours worked each workweek for every covered nonexempt employee. Payroll built on buddy-punched time entries contains systematic inaccuracies in those mandated records. If a Department of Labor audit, a wage claim, or a workers' compensation dispute surfaces your timesheets, you are responsible for their accuracy regardless of how the errors were introduced.

The workers' compensation exposure deserves specific mention. If an employee's record shows them clocked in at 9:00 but they did not physically arrive until 9:45, and an incident involving that employee occurs during that window, your records misrepresent the timeline. That discrepancy can complicate a claim and create liability questions that accurate records would have avoided.

FLSA recordkeeping also matters in wage disputes that have nothing to do with buddy punching directly. Employees who file complaints about missing overtime, misclassification, or wrongful termination give the Department of Labor a reason to examine your time records. A pattern of inaccurate timestamps weakens your position even when the underlying dispute originated elsewhere.

A written buddy punching policy in your employee handbook closes the ambiguity for enforcement purposes. The policy should state that clocking in or out for another employee is a terminable offense, that both parties to a buddy punch arrangement are subject to discipline, that timesheets are subject to audit and photo review, and that disciplinary action does not require proof of intent. Without a written policy, a first-offense termination is easier to contest. With one in place, the expectations were documented and the buddy punching consequences were clear before the incident occurred.

What Actually Stops Buddy Punching

The only reliable fix is an employee authentication method that verifies identity rather than a credential that can be shared. Four approaches work in practice for small businesses running hourly teams.

• Photo capture at punch. A photo time clock takes a picture at every clock-in and clock-out. Photos are stored with the time entry and reviewable during timesheet approval or on-demand audits. The deterrence effect is substantial: employees who know a photo is captured at every punch rarely attempt buddy clocking on someone else's behalf, and rarely ask a coworker to do it for them. You do not need to review every photo to benefit. The credible possibility of review changes behavior without requiring daily surveillance.
• Biometric verification. A fingerprint time clock or facial recognition time clock ties every punch to a physical characteristic that cannot be shared. There is no PIN to text and no badge to hand off. Biometric systems eliminate buddy punching at the hardware level. The trade-off is cost and compliance: dedicated terminals run $150 to $600 per device, and Illinois, Texas, Washington, New York City, and Arkansas require written employee consent before biometric data can be collected.
• GPS geofencing. A geofencing time clock uses location data from a mobile device to confirm the employee is within a defined radius of the work site before accepting a punch. An employee still at home or in the parking lot cannot clock in. A coworker on site cannot clock in for a colleague who is not physically inside the geofence. This is the standard solution for field crews, delivery drivers, and any team using a mobile punch clock app across multiple sites.
• Mobile selfie verification. Some clock-in clock-out apps require employees to submit a photo at punch that is compared to the profile photo on file. This is a lighter-weight alternative to biometric hardware for teams using a mobile time clock without a fixed kiosk. It adds meaningful friction to buddy punching attempts without requiring dedicated hardware or biometric data collection.

Here is how those methods compare for typical small business setups:

Method	Hardware needed	Best fit	Stops buddy punching?
Photo at punch	Tablet or kiosk with camera	Retail, restaurants, fixed locations	Strong deterrent; full audit trail per entry
Fingerprint reader	Dedicated biometric terminal	High-volume or compliance-sensitive teams	Eliminates it entirely
Facial recognition	Camera-equipped terminal	Healthcare, glove-required environments	Eliminates it entirely
GPS geofencing	Employee smartphone	Field crews, remote or multi-site teams	Blocks off-site punches; does not verify identity on-site
Mobile selfie	Employee smartphone	Small remote teams, part-time staff	Moderate; effectiveness depends on active photo review

Kloqk's buddy punching prevention feature uses photo capture at every kiosk punch. The photo is stored with the time entry and visible to managers during timesheet review or on demand. Kloqk's free time clock includes photo capture as a standard feature, not a paid add-on, so small teams do not need to purchase dedicated biometric hardware or move to a premium plan to close the most common identity verification gap on hourly teams.

For teams working across job sites or in the field, GPS geofencing adds a layer that photo capture alone does not provide. The mobile punch clock app will not accept a punch from outside the approved work area regardless of who is holding the device, removing the possibility of clocking in from a car, from home, or from a second location entirely.

The most durable setup pairs the right technology with a clear written policy and consistent enforcement when incidents surface. When employees understand that photos are reviewed and that off-site punches are automatically rejected, the attempt rate drops sharply. The credible possibility of detection is itself the prevention. For a step-by-step guide covering photo punch configuration, GPS geofencing setup, policy language, and how to handle incidents when you find them, see the companion guide on how to prevent buddy punching.

Frequently Asked Questions

What is buddy punching?

Buddy punching is when one employee clocks in or out on behalf of a coworker who is not physically present. The buddy doing the punching is at work; the person being clocked in or out is not. It is a form of employee time theft that inflates payroll and generates inaccurate timesheet records.

Is buddy punching illegal?

Yes. For the employee doing the punching, it is falsifying a business record and can support termination for cause, civil recovery of overpaid wages, or criminal charges depending on the amount and state law. For the employer, 29 CFR 516.2 under the FLSA requires accurate records of hours worked each workday. Payroll built on buddy-punched entries puts that compliance obligation at risk.

How common is buddy punching?

A 2017 survey of 1,000 employees found 16 percent admitted to clocking in for a colleague, roughly one in six hourly workers. In a restaurant or retail store with 15 to 30 employees, that rate suggests two to five people have done it at some point.

How much does buddy punching cost my business?

At 15 stolen minutes per employee per week, a 10-person team at $15 per hour loses $1,950 in overpaid wages annually. That figure grows with team size and hourly rate, and does not include the employer payroll taxes triggered by those overpaid wages.

What is the best way to stop buddy punching?

Systems that verify identity rather than credentials. A photo time clock takes a picture at every punch and creates an audit trail. Biometric terminals (fingerprint or facial recognition) prevent it entirely but require hardware investment. GPS geofencing blocks punches made outside the work site. Kloqk's free time clock includes photo capture at every kiosk punch as a standard feature.