Search for "time theft" and you will find an industry keen to sell you biometrics. Before you buy a fingerprint reader, it is worth separating the three things that get lumped together under that heading, because they have different causes and different fixes.

The three problems

Buddy punching is one employee clocking in for another. It is deliberate, it is unambiguous, and it is genuinely fraud.

Rounding drift is the accumulation of small, mostly innocent inaccuracies: clocking in at 08:52 for a 09:00 start every day, or clocking out at 17:04 because the queue at the terminal was long. Nobody is stealing anything. But at scale it moves real money.

Unrecorded work is the opposite problem, and the one most likely to end up in a tribunal: people working before they clock in or after they clock out. Setting up, cashing up, answering a message from home. It is unpaid work, and the fact that it happened outside the clock does not make it legal.

Treat all three as "time theft" and you will apply a fraud response to two problems that are not fraud. That damages trust and doesn't fix the money.

What actually stops buddy punching

Buddy punching needs a shared credential. Remove the shared credential and it stops.

  • A personal device beats a shared terminal. If people clock in from their own phone, there is nothing to hand over. This is usually cheaper than a biometric terminal and less legally fraught.
  • Location binding. Requiring the clock-in to happen within a defined radius of the site removes the "clock me in, I'm ten minutes away" case entirely. Bind to the site, not to the person's continuous location - the goal is to verify presence at a moment, not to track anyone's day.
  • A photo at clock-in is a lighter-touch alternative to biometrics and, in most jurisdictions, a much simpler consent conversation.

Note what is not on that list: fingerprint and face scanners. They work, but under the GDPR biometric data is a special category with a high bar for justification, and "it is more convenient than the alternatives" does not clear it. If a phone-based clock-in with location binding solves the problem, a regulator will reasonably ask why you collected fingerprints instead.

What actually stops rounding drift

Rounding drift is a process problem. The fixes are unglamorous:

  • Stop rounding in one direction. If your system rounds to the nearest 15 minutes, it should round both ways. Rounding down on arrival and up on departure is a policy of paying less than the hours worked, and it is exactly what an audit looks for.
  • Fix the queue. If eight people clock in at the same terminal at 08:58, the terminal is the problem. More clock-in points, or clocking in from a phone, removes the queue and the drift with it.
  • Compare scheduled to actual weekly, not monthly. A five-minute daily variance is invisible in a month-end total and obvious in a weekly comparison.

What actually stops unrecorded work

This one is cultural, and it is the most expensive to get wrong.

  • Make clocking in the first act of the shift and clocking out the last. If the handover happens after clock-out, the handover is unpaid work.
  • Watch for the pattern where actual hours are consistently lower than scheduled. That is not efficiency. It usually means people are clocking out and then finishing up.
  • Ask. "Is there anything you regularly do that isn't on the clock?" is a question most managers have never asked, and the answers are consistently surprising.

The record-keeping baseline

Whatever you implement, the record has to satisfy three things:

  1. Accuracy - it reflects hours actually worked, not hours scheduled.
  2. Attributability - each entry belongs to an identified person.
  3. Immutability of the trail - corrections are allowed, but the original entry and who changed it must survive. A system where a manager can silently edit yesterday's clock-out to 17:00 is a system with no evidential value at all.

Get those three right and you have a record that protects the business and the employee equally. That is the actual point. Time and attendance is not a surveillance system that happens to produce payroll data; it is a payroll record that happens to require accurate timing.

The order to do this in

  1. Fix rounding direction. It costs nothing and it is the most likely thing to be found against you.
  2. Remove shared credentials. Personal-device clock-in with site binding handles most of it.
  3. Start comparing scheduled to actual weekly and look at both directions of the gap.
  4. Only then consider anything biometric - and if you get to step four, ask honestly what steps one to three failed to solve.