Imagine starting your Monday at 8:00. The punch clock marks you in but there are not enough bodies on the floor. One employee is listed in the system, but his or her body is not physically there. This is called buddy punching and, while many business owners discover it slowly, it comes down to a mismatch between the payroll number and actual output.
The following guide outlines what buddy punching is, what it means for a company with a hundred employees and what red flags can be identified in your data. It will give an analysis of nine methods to prevent buddy punching and the process of handling an incident properly. It is designed for small business owners and HR managers.
"Time buddy punching refers to when an employee clocks in or out on behalf of a colleague who is not present by means of a common punch card, code or simply by tapping their card into the punch machine." This is a case of stealing time at the workplace.
Here's what it looks like in practice:
In most cases, this is not a conspiracy theory. This is simply a favor among friends, and this is precisely the reason behind its propagation. You never feel like a robber when helping a colleague out. If you are interested in the bigger picture, our guide to time theft provides information on that front.
Buddy punching amounts to a cost of roughly $33,000 per year for a firm that employs one hundred people if an employee wastes only four minutes per day at an hourly wage rate of $20 per hour. This is computed by using employees × minutes wasted × hourly rate × 250 days.
Worked example: 100 employees, $20 an hour, 4 minutes a day
Doubling that to 8 minutes a day yields 100 x 8 x ($20/60) x 250, which is approximately $66,700 per year. This is wages alone. No payroll taxes, calculations on overtime hours that are affected, and the harm done to your good employees who realize that the people who steal go unpunished.
For a back-of-the-envelope calculation, just do the math using your employee numbers, average hourly wage rate, and best estimate of time wasted. Even a conservative number tends to shock most people.
It is obvious that some of the clear signs of possible frauds are perfectly timed punches: the same time for all employees, clock ins from locations where no employee works, and punches which do not correspond to what one observes in the real life. Patterns, rather than incidents, should be observed.
Pull a month of punch data and look for these:
Then try the good old-fashioned head count. Go on patrol during an arbitrary period of time, do the head count, and compare the results with who has signed into work. You will know more about the issue in question in just five minutes than in a month of guessing.
Nine ways of preventing buddy punching are listed here in ascending order of cost-effectiveness. Policy, spot check and use of unique PIN code is very inexpensive, though it is the easiest way to cheat. Photographing and GPS tracking are more reliable. Fingerprint or face scanning is the most expensive and difficult to bypass.
Not all of the nine may be needed by most small businesses. The reasonable stack includes a policy, weekly exception reports, and one method of verification which suits your business environment. The first three are available for free.
Biometrics and face recognition close the gap since they authenticate the person himself, not his possession. A badge, a PIN, a password can be borrowed. Fingerprint or facial recognition cannot. The combination of face recognition with liveness detection makes the system resistant to pictures, and it's contactless, so it's useful during peak periods.
All other methods on the list authenticate the credentials. Biometrics authenticates the person. It is just one difference, which makes all the favor go away since there is no way for the credentials to be shared. No one can punch with your face.
The punchcard also provides some traceability since each access attempt is logged with time-stamps and authenticated by face, so there would be no need to argue about who punched the card.
But do not pretend that the technology cannot make mistakes either. Inadequate lighting, use of masks and hasty registration lead to false denials; therefore, always provide an alternative way in for those days. In case you would like to know more details about all of these four biometric methods of attendance tracking – finger, face, iris, and palm - visit our biometric attendance system page.
There is also a legal issue involved here. Since the biometric data is rather sensitive, there are state laws regulating its collection in some US states. Illinois has the BIPA which obligates you to present your privacy policy in writing and get written consent prior to collecting the data. Washington and Texas have similar laws.
Handle a proven case by gathering the evidence, letting both employees explain, and applying your written policy the way you would to anyone else. Keep accurate time records, correct the false punches, and check state law and talk to counsel before firing anyone or trying to recover money.
A fair process looks like this:
Employers and HR teams also read plenty on this atSHRM, which publishes articles on timekeeping fraud and discipline practices. This is general information, not legal advice.
A rollout that avoids backlash starts with telling people why, in plain words, before any device goes up. Explain the problem, show what's collected and how long it's kept, offer a fair alternative where the law expects one, run a pilot, and give everyone a short grace period.
Here's a plan that works for most teams over about six weeks:
One more thing. Don't announce it on the same day you cut a bonus or change shifts. Employees connect the dots fast, and a good system can still feel like a punishment if the timing's wrong.
There are seldom any instances of buddy punching that appear like theft at first glance; rather, they look like favors, which cost actual money. Estimate it based on the formula, analyze your data for the red flags, and begin with the easy solutions. Also, introduce a solution that authenticates the individual and not the card.
If you want to automate the latter process, then attendance.ai provides a facial recognition system for it. In the case of US-based companies, the time and attendance software for small business page explains the process regarding payroll. No matter what solution you go for, but my recommendation would be to discuss the policy, rather than the equipment, first.
Buddy punching is when one employee clocks in or out for another who isn't present. It usually happens through a shared card, PIN, login or punch clock, and the absent employee gets paid for time they didn't work.
Use this formula: employees x minutes stolen x hourly rate x 250 days. For 100 employees losing four minutes a day at $20 an hour, that's about $33,000 a year. Your own figure depends on your wages and how often it happens.
It's usually a policy violation and can amount to fraud or theft of time, depending on the facts and the state. Employers can generally discipline it under a written policy. Check state law and talk to a lawyer before firing anyone or recovering money.
Start with a written policy, spot checks and weekly exception reports. Then add a method that verifies the person, such as a mobile app with GPS and selfie, a fingerprint clock or face recognition with liveness detection.
Yes, but some states regulate them. Illinois' BIPA requires a written policy and written consent before collection, and Texas and Washington have their own biometric laws. Get consent, store templates, not photos, and ask counsel if you operate in those states.