How to stop buddy punching: practical ways to end employees clocking in for each other

What buddy punching is and why it happens

Buddy punching covers a colleague who is late, leaves early or doesn't turn up: someone else signs the sheet, swipes their card or taps the clock for them. Related problems are "padding" (writing in hours that weren't worked, often when a timesheet is filled in at the end of the week) and clocking in from the car park or from home before arriving.

It's rarely a master plan. More often it's a favour between friends, or a habit the system quietly allows. If a punch can be made without the person being there, sooner or later someone will make it.

Costs, installation and data protection for each system are compared in our time clock comparison.

What buddy punching costs you

There's no reliable official figure, but the arithmetic is simple. Take 20 employees, each with 15 minutes a day recorded but not worked, over 21 working days: that's 105 paid hours a month with no work behind them. Multiply by your full hourly cost (pay plus employer's National Insurance or PRSI, pension and holiday accrual) and you have the monthly loss.

• Wages for hours not worked, including overtime and premiums calculated on hours that never happened.
• Wrong client invoices if you bill by the hour – cleaning, security, construction, care.
• Weak records: UK employers must keep records adequate to show compliance with working time limits, and Irish employers must record hours worked for each employee. Identical hours every day in the same handwriting won't convince an inspector.
• Team morale: people who turn up on time see others paid the same for not being there.

The example is illustrative. Plug in your own headcount, the minutes that "slip" on average and your hourly cost. Even five minutes a day across a large team adds up to dozens of hours a month.

7 methods that stop buddy punching

No single check is perfect. The best results come from combining two or three checks that suit each site.

1. Rotating QR code

A tablet or screen at the entrance shows a QR code that changes every few seconds. A photo taken now is useless a minute later, so it can't be shared in a group chat. Where there's no screen, a printed fixed QR code works well combined with GPS. See QR code time clock.

2. GPS zone (geofence)

A punch is accepted only inside the radius you set around the site. The phone's location is read once, at clock-in or clock-out – not tracked through the day. A punch just outside the zone isn't lost; it's flagged for you to decide. More in GPS time clock.

3. One phone per employee

Each employee's account is tied to their own phone. A new device needs manager approval, so nobody can clock in five colleagues from one handset.

4. Selfie at clock-in

The employee takes a photo when clocking in. Managers look at it only when something seems off. It isn't used for automated facial recognition and is deleted automatically after 30 days. It's a strong deterrent: nobody wants to take a selfie on a colleague's phone.

5. Face ID or fingerprint checked on the phone

The employee confirms the punch with Face ID or fingerprint through passkeys, just like a banking app. The check happens on the phone; QRtimetrack only receives confirmation that it's the phone's owner. You store no fingerprints and no face templates.

6. Entrance kiosk with photo

For staff without smartphones: a tablet at the entrance with a personal PIN, a printed badge or a personal code on the employee's phone that changes every 30 seconds. The kiosk can take a photo with each punch, so you can see who was actually standing there.

7. A review queue for team leads

Every punch gets a traffic light: green, yellow or red. Red means, for example, outside the GPS zone, a changed phone clock, or two punches too far apart for the time between them. Team leads review only the doubtful ones from the team-lead app, and rejected punches don't count towards hours.

Start the free trial

Which combination for which site

Overtime can require its own confirmation, with a QR scan and photo when the extra hours start – so premium hours come with extra proof.

What's lawful: UK GDPR, GDPR and proportionality

You're entitled to check that punches are genuine, but the means must be proportionate. Data minimisation (Article 5(1)(c) of the GDPR and UK GDPR) means collecting only what you need for the purpose.

• Fingerprints and facial recognition held by the employer are biometric special category data under Article 9. You need a valid condition, and employee consent is hard to rely on because staff aren't free to refuse their employer. A data protection impact assessment (DPIA) is generally expected.
• GPS only at clock-in is far easier to justify than continuous tracking: one location point to confirm the punch was made at work. The ICO's guidance on monitoring workers expects monitoring to be necessary, proportionate and transparent.
• Selfies are still personal data. Decide how long you keep them and who can see them.
• Tell employees in writing what you collect, why, for how long and who has access.

In February 2024 the UK ICO ordered Serco Leisure and associated trusts to stop using facial recognition and fingerprint scanning to monitor staff attendance at leisure centres, finding that less intrusive options such as ID cards or fobs were available.

Buddy punching can also be a disciplinary matter if your policies say so. Before acting, you need evidence: a system that records time, location and optionally a photo for each punch gives you that evidence without guesswork. Follow your disciplinary procedure (in the UK, the Acas Code of Practice; in Ireland, the Code of Practice on Grievance and Disciplinary Procedures, S.I. 146/2000) and take advice before dismissing anyone.

Checklist: stop buddy punching in two weeks

1. Measure the problem. Compare a month of timesheets with reality: identical hours every day, similar signatures, people "present" whom nobody saw.
2. Choose a method per site from the table above. Don't apply the same rule to the office and the building site.
3. Put the rule in your handbook: everyone clocks in only for themselves, from their own phone or at the kiosk.
4. Tell employees in writing what data you collect (GPS at clock-in only, optional selfie kept 30 days).
5. Switch on the app and run it in parallel with the old system for a week.
6. Decide who reviews the suspicious-punch queue and how quickly (for example, the same day).
7. Close the month: employees confirm their hours on their phone before payroll.
8. Review after a month: how many red punches, and is the GPS radius right?

Create a free account

What it costs with QRtimetrack

€1.99 per active employee per month, minimum 5 employees billed (€9.95 a month for up to 5), excluding VAT. No hardware, no installation, no long contract. The 7-day free trial covers up to 10 employees and needs no card. See pricing.

For a three-year cost comparison with a fingerprint clock, see employee time clock. For the full product overview, see the time tracking app.

Frequently asked questions