Buddy punching: the expensive answer and the working one
Somebody clocks in for a colleague who is not there yet. It is the oldest problem in attendance, and the product the industry sells for it is the one most likely to get you in trouble.
Why biometrics is the wrong first move
In February 2024 the Information Commissioner ordered an employer to stop using facial recognition and fingerprints for staff attendance across 38 sites and to destroy the data. The central finding: biometric data cannot be necessary to check attendance when less intrusive methods exist. The regulator named them — cards, fobs, a sign-in sheet.
The detail worth knowing: the employer had a real problem with the previous system, and still lost, partly because it had not tried disciplining the few people abusing it. Buying technology instead of managing the issue was itself part of why the necessity argument failed. The full reasoning.
What a card and a proper record actually catch
- The device and the exact time of every punch. Two clock-ins thirty seconds apart on the same tablet, every morning, is a pattern you can see.
- Clocking places, if you switch them on: the punch is checked against the site at that moment. Not continuous tracking — one check, and the person sees it.
- An audit trail. Every correction shows who, when and why, with the original preserved. That is what turns a suspicion into something you can actually rely on.
- The rota beside the record. Hours clocked against shifts planned makes the anomaly obvious without anyone hunting for it.
The uncomfortable part
Most of what gets called time theft is not theft. It is five minutes of rounding, a break that ran long, a shift that started late because the previous one over-ran. Chasing that with surveillance costs more in goodwill than it recovers in minutes, and it tends to produce a worse record, because people who feel watched start gaming the clock rather than using it.
Where there is genuine, repeated abuse, the answer is a clear rule, a record you can rely on, and your own disciplinary process. Software supplies the second one. It cannot supply the other two, and any vendor implying otherwise is selling you a shortcut around a conversation you will have to have anyway.
Questions we get
Does a fingerprint reader stop buddy punching?
It does, and it brings a data protection problem that the ICO has already acted on. In 2024 it ordered an employer to stop biometric attendance checks and destroy the data, holding that biometrics cannot be necessary when a card or a sign-in sheet would do. The reasoning.
What can we do instead?
Cards plus the device and exact time of every punch, which is enough to see a pattern. A person clocking in from the same device thirty seconds before a colleague every morning is visible in the data without anyone being scanned.
Can we discipline someone over clocking?
That is an employment matter, not a software one, and it needs your own process. What the software gives you is a record with an audit trail, where the original entry and any correction are both preserved — which is what makes it usable evidence rather than an allegation.
Is rounding time theft?
Rounding is a policy choice and it can cut either way. What matters is that the rule is written down, applied to everyone, and visible in the record — rounding that quietly always favours the employer is the version that ends up in a tribunal.
Free for up to 3 employees, forever
Thirty days with everything included, AI assistant and all, no card and no automatic renewal. When the trial ends, companies with up to 3 employees simply keep working for free. And within the first 60 days you get your money back if it does not fit.
Questions? Write to time@irot.com. We answer on working days, usually by the next one.