What actually counts as time theft
Time theft is getting paid for time you didn't work. The everyday forms: rounding up a timesheet, taking a 40-minute lunch on a 30-minute clock, running personal errands mid-shift, and buddy punching — having a coworker clock you in or out so the record says you were there when you weren't.
Worth saying plainly: some of what gets labeled time theft is really a management problem. An employee who's idle because the schedule is bad isn't stealing anything. The part software can fix — and the part this guide covers — is punch integrity: making the clock-in record match physical reality.
Buddy punching, mechanically
Buddy punching survives because most time-tracking setups authenticate a code, not a person. A shared PIN pad, a wall tablet with a 4-digit code, a paper sign-in sheet — none of them know who's actually standing there. Text a friend your PIN and you're “at work” while you're in traffic. It rarely feels like fraud to the people doing it, which is exactly why it's so widespread: it's a favor between coworkers, fifteen minutes at a time.
What it costs
The honest caveat first: most time-theft statistics trace back to industry groups and vendors with time clocks to sell, so treat precise figures as directional. That said, the numbers that get cited most — Nucleus Research putting buddy punching at about 2.2% of gross payroll, an American Payroll Association estimate that roughly three-quarters of U.S. businesses experience it, and around $373 million a year in losses — would be alarming even if you cut them in half.
Case file · Nucleus Research
2.2%
of gross payroll lost to buddy punching. For a crew of 20 at $18/hour, that's roughly $16,000 a year.
Run your own arithmetic instead of trusting anyone's statistic: take your gross hourly payroll, assume each employee's clock records flatter them by five to ten minutes a day, and see what that costs annually — or let our cost calculator do it for you both ways. For most hourly operations the answer is “more than the software that would fix it.”
Is buddy punching illegal?
Falsifying time records is grounds for termination almost everywhere, and in egregious, sustained cases employers have pursued it as theft. In practice, though, it's handled as a discipline problem, not a criminal one — a first offense is a conversation, a pattern is a firing.
The trap on the employer side: under federal wage law you generally still owe pay for hours actually worked, and docking pay as punishment is legally messy. Discipline the dishonesty; don't improvise deductions. And before you install anything biometric, know that states like Illinois (under BIPA) regulate fingerprint and face data aggressively enough that lawsuits over time clocks are their own legal genre. None of this is legal advice — an employment lawyer is cheaper than either mistake.
How to actually stop it
- Photo capture on punch.The clock takes a picture at clock-in; a supervisor (or the software) flags mismatches. This is the cheapest fix with the best return, and it's standard in tools like Buddy Punch and Homebase. Most buddy punching stops the day the camera turns on.
- GPS and geofencingfor field crews: the punch only counts inside the job site's radius. QuickBooks Time and When I Work both do this well for mobile teams.
- Biometric clocks — fingerprint or face — close the loophole completely, at the price of hardware costs and the privacy law exposure above. Right answer for some warehouses; overkill for a café.
- Someone reading the exception report. Every decent time clock produces one — edited punches, missed punches, overtime spikes. It only deters anything if employees know a human looks at it. Enforcement beats hardware.
The full field, compared: the best time theft & buddy punching prevention software, and the wider time & attendance category.
The policy side
Write the rule down before you enforce it: clocking another employee in or out is falsification, first instance gets a documented warning, pattern gets termination. Apply it evenly — the fastest way to lose a wrongful-termination argument is to fire the line cook for what the shift lead does weekly. And if buddy punching is rampant, ask why people feel they need it. Sometimes the answer is a broken clock-in process, a schedule nobody can physically make, or a manager everyone routes around. The software fixes the symptom either way; occasionally the diagnosis is more useful.
Time theft is one flavor of a bigger problem — for the rest of the taxonomy, start with what is payroll fraud.