Buddy Punching and Time Theft: What They Really Cost Small Businesses in 2026

What Is Buddy Punching and What Does It Cost?

Buddy punching is when one employee clocks in or out for another who is not actually at work. It is a form of time theft: paid time that was never worked. It usually happens on shared PIN pads, paper timesheets, or web clocks with no identity check.

The most defensible estimate puts the cost at around 2.2 percent of gross payroll for hourly teams that use unverified clocks. For a 15-person team averaging $18 an hour, that is roughly $12,000 a year. You can stop most of it with photo-verified clock-in and geofencing, and you rarely need fingerprint scanners to do it.

Now the part most vendor blogs skip: several of the numbers you have read about time theft are inflated, recycled, or both. Let's separate the real ones from the marketing.

Which Time Theft Statistics Actually Hold Up?

Search this topic and you will meet the same three claims on every page. They deserve different levels of trust.

ClaimOriginal sourceHow much to trust it Time theft affects 75% of US businessesAttributed to the American Payroll Association, original survey hard to traceLow. Repeated for over a decade without a checkable source. Employees steal 4.5 hours per weekOften credited to APA or decades-old Robert Half surveysLow. That is over half a workday, every week, per person. Ask yourself if that matches your floor. Buddy punching costs 2.2% of gross payrollNucleus Research (2008 study)Moderate. Old, but a real study with methodology, and the figure is conservative enough to plan around. Roughly 1 in 5 employees admit to buddy punchingVendor-run employee surveys, commonly cited as 16 to 19 percentModerate. Self-reported, but consistent across multiple surveys.

You will also see totals like "$373 million a year" or even "$400 billion in lost productivity" in articles like this one from Asure. Treat national totals as noise. The number that matters is yours.

What Does Buddy Punching Cost Your Team, Specifically?

Run the honest math with the conservative figure. The 2.2 percent estimate and the 19 percent admission rate both appear in Synerion's roundup of the research:

1. Take your annual gross payroll for hourly staff. Example: 15 people, $18 an hour, full time, about $561,000.
2. Multiply by 2.2 percent: about $12,300 a year.
3. Compare that against what fixing it costs. Attendance software at a flat fee runs $600 to $1,200 a year for a team this size.

If your team is salaried, remote, and output-measured, your exposure is far lower and this whole problem may not be worth a single meeting. Buddy punching is an hourly, shift-based problem.

How Do You Stop Buddy Punching in 2026?

There is a ladder of fixes, from free to invasive. Climb only as high as your actual problem requires. We compared the main options in more depth in our guide to the best attendance tracking software for 2026, but here is the short version:

MethodStops buddy punching?CostWatch out for Paper timesheets or honor systemNoFreeNo identity check at all. Also weak as a legal record. Shared PIN or badge clockNoLowPINs and badges are exactly what buddies share. Selfie or photo-capture clock-inYes, nearly all of itLow (built into most apps)Someone should actually review flagged photos. Geofencing / GPS clock-inYes, off-site punchingLow (built into most apps)Set a sensible radius or you will get false alarms. Fingerprint or face biometricsYesHardware plus legal riskBiometric privacy laws. Overkill for most small teams.

For most small businesses, selfie verification plus geofencing is the ceiling. The employee opens the app on their own phone, takes a photo, and the system confirms they are inside the worksite radius. Nobody can hand that to a buddy.

One honest caveat: tell your team before you turn these on, and explain why. A verified clock rolled out quietly reads as surveillance. The same feature announced as "everyone gets paid for exactly what they work, including you" reads as fairness. Rollout tone decides which one you get.

Why Should Small Businesses Be Careful With Biometric Time Clocks?

Fingerprint scanners sound like the strongest fix, and vendors love selling the hardware. But if you operate in Illinois, collecting fingerprints without written consent and a retention policy violates the Biometric Information Privacy Act, which allows employees to sue directly. Employers have paid large settlements over time clocks alone. Texas and Washington have their own biometric laws.

A selfie stored as a photo with clear consent carries far less legal weight than a fingerprint template. Same anti-fraud result, much smaller blast radius.

When Is Time Theft a Management Problem, Not a Software Problem?

Here is the part vendors will not tell you: software catches the symptom. If buddy punching is common on your team, one of these is usually the disease.

• Chronic understaffing. When one late bus means a missed shift and a write-up, employees build cover-me pacts. Fix the scheduling slack first.
• Punitive rounding and lateness policies. If clocking in 4 minutes late costs 30 minutes of pay, people will route around the clock. That rounding practice may also violate wage rules, since the FLSA requires accurate records of hours actually worked.
• Managers who edit timesheets down. Time theft runs both directions. Shaving employee hours is wage theft, and it destroys any moral authority you have on punch accuracy. Clean, tamper-evident attendance records that meet wage and hour rules protect you from both failure modes.
• Nobody looks at the data. A time clock nobody audits is theater. Fifteen minutes a week reviewing exceptions beats any hardware upgrade.

If attendance is slipping across the board, the fix is rarely a stricter clock. It is usually expectations, scheduling, and follow-through, which we cover in building a culture of attendance beyond the time clock.

What Should You Do This Month?

1. Estimate your real exposure with the 2.2 percent math above. If the number is trivial, stop here.
2. Write a two-paragraph policy: clocking in for someone else is falsifying a pay record, first offense gets a documented warning.
3. Turn on photo capture and geofencing in your time tracking app. Skip biometric hardware unless you have a documented fraud problem and legal review.
4. Put a 15-minute weekly exception review on a manager's calendar.
5. Audit your own side: rounding rules, timesheet edits, and unpaid wait time.

Most teams that do steps 2 through 4 see buddy punching drop to near zero within a pay period, because it only survives where nobody is checking. If your current clock cannot verify who is punching, that is the gap to close first: TracefyHR's attendance tracking with selfie verification and geofencing handles it from the phones your team already carries, with no extra hardware.

Frequently Asked Questions

What is buddy punching?

Buddy punching is when an employee clocks in or out for a coworker who is not present, creating paid time that was never worked.

Is buddy punching illegal?

It is not a specific crime, but it falsifies pay records, and employers can lawfully discipline or fire employees for it. At scale it can support fraud claims.

How common is buddy punching?

Surveys consistently find that roughly one in five hourly employees admit to having punched in for a coworker at least once.

How much does time theft cost employers?

The most defensible estimate, from Nucleus Research, puts buddy punching at about 2.2 percent of gross payroll. Larger viral figures are mostly unverifiable.

How do you prevent buddy punching?

Use a clock that verifies identity and location: photo capture on the employee's own phone plus a geofence around the worksite stops nearly all of it.

Can you get fired for buddy punching?

Yes. Both the employee who asked and the one who punched can be disciplined or terminated for falsifying time records.

Are fingerprint time clocks legal?

Generally yes, but Illinois, Texas, and Washington regulate biometric data, and Illinois BIPA lawsuits over time clocks have cost employers millions. Get consent in writing.