What is buddy punching?

Buddy punching is one person clocking in or out for another, so a timesheet shows hours the absent person did not work. It is a form of time theft and usually happens on shared kiosks, badge readers or phones.

What is an example of buddy punching?

A Crew Member is running 20 minutes late and texts a coworker already on site, who enters their PIN at the kiosk. The timesheet shows an on-time start, the agency pays for the full shift, and the client is billed for 20 minutes nobody worked.

Can you be fired for buddy punching?

Often, yes. Most employers treat it as time theft under their attendance or conduct policy. The consequence should be written in the policy and applied consistently, and hours actually worked still have to be paid.

Does geofencing stop buddy punching?

Geofencing confirms the phone is at the job site when the punch happens. Adding a photo at clock-in confirms who is holding it. Together they remove the two ways buddy punching usually works.

How do you prevent buddy punching without biometrics?

Use mobile clock-in with a location check at the site and a photo at every punch, lock kiosks to the site network, and have clients approve hours. That covers most cases without collecting fingerprints or face scans.

Buddy Punching

September 25, 2026

6 min read

Timesheets

Written by the NextCrew team

Definition

Buddy punching is when one person clocks in or out for someone else, recording time the absent person did not work. In staffing it usually means a Crew Member asking a coworker to punch for them on a shared kiosk, badge reader or phone, so the agency pays and bills hours nobody verified.

Buddy punching is a form of time theft, and it is usually small, friendly and repeated. One person runs late, a friend clocks them in, and the timesheet says they were on site. For a staffing agency the cost lands twice: the agency pays the wages, and the client is billed for hours it may later dispute.

How does buddy punching happen with each clock-in method?

Clock-in method	How buddy punching happens	What closes the gap
Paper sign-in sheet	Anyone can write any name and time	Replace it; paper cannot be verified
Shared PIN or badge kiosk	A coworker enters the PIN or swipes the badge	Photo at clock-in and a supervisor who can see the kiosk
Phone app with no location check	Someone clocks in from home, or on a friend's phone	Location check at the job site plus a photo
Geofenced app with photo	Hard: the phone must be at the site and the photo shows who	Review exceptions, not every punch
Supervisor entry	Only if the supervisor records someone who is not there	An audit trail showing who entered it and when

Most buddy punching needs two things: a clock that cannot tell who is using it, and nobody checking.

Why does buddy punching cost staffing agencies more?

Because an agency sits between the hours and the client. An employer that runs its own site loses the wages. An agency loses the wages, risks a billing credit when the client notices, and loses some of the client's trust in every other timesheet it sends.

Billing disputes. A client who finds one false punch starts questioning all of them, and approvals slow down.
Bad attendance data. A buddy-punched Crew Member looks reliable on paper, so they keep getting shifts a real no-show record would have flagged.
Safety and insurance. The record says someone was on site when they were not. That matters if there is an incident.

Is buddy punching illegal?

Buddy punching is usually treated as a serious policy violation and a form of time theft, and it can lead to discipline or termination. Whether it is also treated as fraud depends on the facts and the state. What does not change: you still have to pay for time actually worked, so the fix is better records, not docking pay on a hunch. Put the rule in writing, have Crew Members acknowledge it at onboarding, and apply it consistently.

A caution on biometric time clocks: fingerprint and face scanners stop buddy punching well, but some states regulate biometric data. Illinois' Biometric Information Privacy Act, for example, requires written consent before collecting fingerprints or face geometry. Get legal advice before rolling one out.

How do you spot buddy punching?

Matching punches. Two people clocking in within seconds of each other, day after day.
One device, several people. Different Crew Members clocking in from the same phone or kiosk session.
Location that does not fit. A clock-in recorded away from the job site.
Photo that does not match. The face at clock-in is not the person on the timesheet.
Supervisor contradiction. The site lead says someone was absent, but the timesheet shows a full shift.

How do you prevent buddy punching?

1
Capture a photo at every clock-in and clock-out
It answers the question a location check cannot: who is holding the phone.
2
Geofence mobile clock-in
The punch is tied to the job site, so clocking in a friend from the parking lot of another building stops working.
3
Lock kiosks to the site network
A kiosk that only accepts punches from an approved network cannot be used from anywhere else.
4
Let the client approve hours
A site manager who approves the timesheet is a second pair of eyes on who was there.
5
Write the policy down
Define buddy punching, state the consequence, and get an acknowledgment at onboarding.
6
Review exceptions weekly
Look at manual entries, out-of-area punches and photo mismatches, not every punch.

Where agencies get it wrong

Treating every manual entry as suspicious. Supervisor entry exists for real reasons: a dead phone, a site that bans phones. Audit it; do not ban it.
Acting without evidence. Discipline based on a hunch invites a dispute you cannot win.
Relying on the client to police it. The client's supervisor has their own job. Build the check into the clock.
Buying biometric hardware first. Consent rules and cost come with it. A phone with location and a photo often does the job.

Bottom line: buddy punching survives wherever a clock cannot tell who is using it or where. Verify both at the moment of the punch and most of it disappears.

How NextCrew handles buddy punching

Geofenced mobile clock-in. Verifies the Crew Member is at the job site, with GPS coordinates and a photo captured at every clock-in and clock-out.
Photo requirement. Agencies can configure NextCrew to require a photo at clock-in and clock-out.
Kiosks on approved networks. Kiosk clock-in only works from an approved IP address, on any internet-capable tablet.
Location on the timesheet. The timesheet shows on a map where the Crew Member was standing when they clocked in.
Client approval. Clients can approve or decline timesheets in their portal.
A health check. Mobile clock-in stats show what share of timesheets came from the app or kiosk versus manual entry.

Read more about geofencing or see timesheet management software.

Frequently asked questions

Related terms

Geofencing: a virtual boundary that checks a clock-in happens at the job site.
No-show: a Crew Member who misses a shift; buddy punching can hide one.
No call no show: a missed shift with no warning at all.
Time clock rounding: recording punches to the nearest increment, and when that is allowed.
Attendance point system: a policy that scores lateness and absences.

All-in-one. Built for
your staffing business.

Every Vertical Has Its Own Breaking Point

Built For Agencies Everyone Else Overlooked

The Best Agencies Don't Fix Problems — They Prevent Them.