← All posts
Compliance

How to Stop Buddy Punching: 7 Methods That Actually Work

Buddy punching is the polite term for an old habit — one employee clocking in for another. The American Payroll Association estimates it costs U.S. businesses $373 million per year, and the small-business version isn’t the dramatic stuff: it’s the once-a-week, fifteen-minute, “clock me in, I’m running late” favors. They add up to roughly 2.2% of gross payroll. Here are seven ways to stop it that actually work — ranked by friction, cost, and how much your team will hate you afterward.

$373M
Annual cost in U.S.
2.2%
of gross payroll
75%
of businesses affected

Why buddy punching happens

It almost never starts as theft. It starts as kindness — a colleague’s train was late, traffic was bad, the alarm didn’t go off. Three months in, it’s a routine. By the time anyone notices, the timesheet has been quietly off by 20 minutes a week per offender for half a year.

That’s why the prevention strategy matters more than catching one offender. You want a system where buddy punching is impossible by default, not punished after the fact.

1. GPS + geofencing (lowest friction)

How it works: the app captures coordinates at clock-in and checks them against a geofence drawn around your location.

What it stops:the “clock me in, I’m on the bus” case — the most common one.

Friction: almost none. The employee taps a button; the app does the work. Modern phones grant the permission once and forget.

Catch: works only if employees use their own phones. If half your team is sharing one device, see method 2.

2. Kiosk mode with PIN entry

How it works: a tablet at the door runs the kiosk. Employees punch in with a 4-digit PIN.

What it stops:“I forgot my phone” excuses; eliminates the “clock me in remotely” case.

Friction: low. Five seconds at the door.

Catch: a PIN can still be shared. Most teams find this acceptable when the kiosk is physically present — sharing a PIN means the friend has to physically come to the door, which removes most of the appeal. For higher-trust environments, combine with method 3.

3. Kiosk mode with selfie verification

How it works: tablet kiosk takes a quick selfie on punch-in. Manager review or face-match locks the punch to the employee.

What it stops: nearly all buddy punching.

Friction: moderate. Adds 2–3 seconds per punch, plus occasional manager review.

Catch: some employees object on privacy grounds. Document it in the handbook before rollout.

4. Biometric scanners (fingerprint / face)

How it works: a hardware scanner mounted near the entrance.

What it stops: all buddy punching.

Friction: hardware setup, ongoing maintenance, legal disclosures (Illinois BIPA and similar state laws).

Catch: the legal exposure is real. Several states require explicit written consent and limit data retention. For most small teams, this is overkill — the kiosk-plus-selfie route is comparable in effectiveness without the legal load.

5. Exception inbox + audit log

How it works: every flagged punch (out of bounds, mis-typed PIN, manual edit) lands in a single review queue. Managers clear it once a day.

What it stops:the long tail of edge cases the first four methods don’t catch.

Friction: none for employees. Five minutes a day for the manager.

Catch: only as good as the manager who reviews it. Set a daily 9 a.m. inbox-zero ritual.

6. Schedule + clock-in matching

How it works: the app refuses early clock-ins more than 5 minutes before a scheduled shift, and prompts on unscheduled punches.

What it stops:“clock me in early, I’m already on the way” padding.

Friction: minimal once schedules are accurate.

Catch: requires you to actually publish schedules.

7. Culture and exit interviews

Every long-running buddy-punching habit traces back to a culture problem: under-staffing, unrealistic schedules, or a manager people don’t want to disappoint by saying “I’m late.”

  • Build slack into the schedule. A 15-minute grace window kills 60% of the casual buddy-punching cases overnight.
  • Make “text me when you’re running late” a stated norm. The fewer reasons to lie, the less lying.
  • In exit interviews, ask: “Did anyone ever clock in for you, or vice versa? No judgment, just curious.” You’ll learn more in five minutes than from any audit.

FAQ

How much does buddy punching actually cost?
The American Payroll Association estimates ~2.2% of gross payroll. For a 10-person team paying $400K/year, that’s roughly $8,800 a year — typically more than the cost of any prevention tool.
Is GPS time tracking enough on its own?
For teams using their own phones, yes — it solves about 80% of buddy punching with near-zero friction. For shared-device teams, pair GPS with kiosk PINs.
Are biometric time clocks legal?
Generally yes, but several states (notably Illinois under BIPA) require written consent, restrict storage, and impose retention limits. Consult counsel before deploying biometrics.
Can I catch buddy punching after the fact?
Sometimes — review punch coordinates, check for impossibly short travel times between locations, and look for repeating patterns at the start or end of shifts. The exception inbox does most of this automatically.
Keep reading
Compliance

Clocking in and out policy template (free, defensible)

Compliance

Geofencing for Employees: Legal, Practical, and How to Roll It Out

Comparisons

ClockOut vs Hubstaff: which is right for your team in 2026