How to stop buddy punching (without treating staff like suspects)

Updated 28 September 2026

Buddy punching is when one person clocks in (or out) for a colleague who isn’t there yet, or has already left. It’s usually small favours, not fraud, but it adds up, and it makes your time records wrong.

The good news: a few simple choices make it hard to do and easy to notice.

Make each clock-in personal

A PIN per person at a shared tablet. It’s quick, and a colleague has to know yours.
A personal badge on each person’s phone, scanned at the tablet. Harder to share than a PIN.
Clock in on their own phone, tied to their own login.

Check where, only when it matters

With phone clock-in, check location once, at clock-in and clock-out, against the site’s boundary. There’s no need to track anyone all day. Punches outside the boundary can be flagged for review (the friendly option) or refused (the strict one).

For sites without a tablet, a printed code on the wall proves someone was physically there when they scanned it.

Add a photo if you need to

A photo at clock-in is the strongest deterrent, and it’s simplest at a shared tablet. Use it where it’s justified, tell staff it’s on, and keep photos only as long as you need them.

Notice the pattern

Even with good tools, look at the patterns:

The same device clocking in several people minutes apart.
Flagged punches: outside the boundary, not at the rostered site, or made offline.
Late and no-show reports against the roster.

Keep it fair

Tell staff how clock-in works and why. Most buddy punching stops once everyone knows each clock-in is personal and checked. Handle the rest as a conversation, not an accusation.

How Vaultime helps

Vaultime has personal PINs and phone badges at the kiosk, GPS boundaries checked only at clock-in and out (flag or refuse, per site), rotating and printed QR codes, an optional photo at each kiosk punch (kept 90 days by default), and flags managers review before approving. See clock-in in Vaultime.