Buddy punching is when one employee clocks in or out on behalf of another. One person is already at the site, so they punch in their absent or late colleague. It happens constantly in shift-based workplaces, and most employers have no idea how much it’s costing them. According to the American Payroll Association, buddy punching costs employers an estimated 2.2% of gross payroll annually.

It Starts With a Favour

“Hey, I’m stuck in traffic. Can you just punch me in?”

That’s how it starts. A favour between coworkers. Nobody thinks of it as theft. But those small acts of coverage add up fast, and the person paying for them is you.

Buddy punching is most common in shift-based environments: restaurants, retail, manufacturing, warehouses, healthcare, construction. Anywhere people work in groups, share schedules, and have access to a shared punch clock or time tracking system.

It’s not confined to any one industry. If your workforce punches in and out, buddy punching is likely happening.

The Real Cost: Run the Numbers

Most employers know buddy punching exists. Few have actually calculated what it costs them.

Here’s a straightforward model. Take a 100-person hourly workforce. Assume 10% of employees buddy punch twice a week, 15 minutes each time. That’s 10 employees, 2 incidents per week, 15 paid minutes per incident.

The math:

• 10 employees x 2 incidents x 15 minutes = 300 minutes per week
• 300 minutes = 5 hours per week in overpaid wages
• 5 hours x 52 weeks = 260 hours of overpaid wages per year
• At $22/hour average: $5,720 in wasted payroll annually

Now scale that up. A 250-person workforce at the same rate loses 650 hours and roughly $14,300 per year. Before you factor in the employer’s CPP and EI contributions on those overpaid wages.

The American Payroll Association puts the broader estimate at 2.2% of gross payroll. For a Canadian company with 100 hourly employees averaging $22/hour on a 40-hour week, that’s an annual payroll of about $4.6M. Two point two percent of that is over $100,000 in time theft exposure per year across the workforce.

Why It’s So Hard to Catch

The honest answer: most time tracking systems aren’t built to stop it.

Paper timesheets are the worst offender. A supervisor signs off at end of week. Nobody checks whether John was actually there at 7am Tuesday or whether his colleague signed for him. The record says he was there. That’s the whole audit trail.

Basic punch clocks are only marginally better. A PIN or swipe card can be handed off in 10 seconds. If there’s no biometric verification, there’s no way to know who actually pressed the button.

“Honour systems” are not systems. They’re assumptions.

Even some digital time tracking tools have this gap. If employees can log in from a shared device with just a username and password, one person can record attendance for another without ever being flagged. The software records the event. It doesn’t verify the person.

How Buddy Punching Actually Happens

The method depends on the system in place.

PIN-based punch clocks: Someone learns a colleague’s PIN. That’s it. One conversation and they can clock them in from anywhere on site. This is by far the most common attack vector.

Swipe card systems: The employee hands their card to a coworker. Physical tokens are easy to share. No identity check required.

Password-based apps: If your workforce uses a shared tablet or a web portal, employees can log in as each other if credentials are shared. Same problem, different interface.

Paper sign-in sheets: Someone signs the sheet for an absent colleague. The supervisor sees a signature. There’s no way to verify it’s authentic without a handwriting analysis nobody is going to do.

The only systems that stop buddy punching are ones that verify identity at the point of clock-in, not just the credentials.

The Legal Exposure Canadian Employers Overlook

Time theft is grounds for termination in Canada. Courts and employment tribunals have consistently upheld that an employee clocking in when they weren’t present, or having someone do it for them, constitutes a fundamental breach of the employment relationship.

The problem is proving it.

Without a digital audit trail showing who clocked in, from which device, at what location, at what time, you have a suspicion and no case. A wrongful dismissal claim can succeed even when the employer was right about the behaviour, simply because the evidence wasn’t there to support the decision.

Employers who try to terminate for buddy punching without supporting records often find themselves paying out instead of recovering stolen wages.

How to Stop Buddy Punching

The fix is straightforward. Make it physically impossible to clock in as someone else.

Biometric Time Clocks

Fingerprint or palm scanners verify identity at the hardware level. You can’t hand off a fingerprint. You can’t guess it. You can’t share it over text. Biometric time clocks are the single most effective deterrent for on-site buddy punching and they’ve become affordable enough for workforces of 50 or more employees to justify the cost.

Facial Recognition

Camera-based clock-in takes biometric verification mobile. Employees punch in from a tablet or kiosk that verifies their face before recording the time entry. No physical scanner required. Works well in environments where a fixed fingerprint scanner isn’t practical.

Geofencing

Geofencing ties clock-in events to a physical location. If an employee tries to punch in from outside the defined boundary (your warehouse, your restaurant, your job site), the system rejects it. A coworker at home can’t clock in a colleague who is also at home. This doesn’t work for mobile or distributed teams, but for fixed-location workforces it adds a meaningful layer of control on top of any other verification method.

GPS Check-In for Remote and Field Workers

For construction crews, home care workers, field service teams, or anyone working off-site, GPS check-in records location at the moment of clock-in. The time entry is stamped with coordinates. You can see whether the employee was actually at the job site or 40 kilometres away when they punched in.

Digital Audit Trails

Even without biometrics, a proper digital time tracking system creates records that paper never could. Timestamp, device ID, IP address, user account, and geolocation, all logged together for every clock-in event. When a discrepancy surfaces, you have something to investigate. And if you need to act on it legally, you have something to show.

See how payroll records connect to this: if your payroll system can’t even flag discrepancies in time entries before processing wages, the problem compounds every pay cycle. Read our related post on 7 signs your payroll system is failing to see if your current setup is making you more exposed than you realize.

Where Workzoom Fits

Workzoom’s Workforce Suite handles time tracking, scheduling, and attendance in one system. Geofencing and GPS check-in are built in. The system creates a full audit trail on every clock event. When time entries feed directly into payroll, there’s no manual re-entry, no spreadsheet step, no opportunity for unverified numbers to become paycheques.

Workzoom has been operating in Canada for 25+ years, built from the ground up for Canadian compliance. The Workforce Suite runs $4/employee/month. No setup fees. No contracts. Month-to-month.