The favour that rewrites the payroll
“Clock me in, I’m five minutes away” never feels like fraud — which is exactly why it works. Where buddy punching comes from, and how to end it without pointing a fingerprint scanner at your own team.
Why decent people do it
Buddy punching is rarely villainy. It is a colleague running late, a friend covering the awkward five minutes, a culture where the favour is small and the harm invisible. But payroll pays the record, not the reality — and once the favour is normal, the record and the reality drift apart for good.
It thrives on systems that trust whoever is holding the credentials. A shared PIN can be recited to anyone. A wall QR code can be photographed once and scanned from anywhere, forever. A web clock-in that works from any location is an invitation to clock in from the bus. None of these systems can tell the difference between a person and a person’s friend.
The biometric trap
The industry’s standard answer is to verify the body: fingerprint or face at the door. It does stop buddy punching — and it converts your attendance system into a biometric database.
Under UK GDPR, biometric data used to identify someone is special category data. That means a data protection impact assessment, a lawful basis strong enough to survive scrutiny in an employment relationship where consent is rarely freely given, and honest answers to staff asking where their fingerprints live and who else can reach them. For a small organisation, that is a heavy legal apparatus to bolt onto a signing-in sheet — and a hard conversation to have with a team you trust.
Bind the person and the place, not the body
Buddy punching needs two things to be separable: the credential and the location. Remove the separation and the favour becomes impossible without becoming surveillance.
A tap-at-the-door system does this with two locks. The tap only exists at the wall — the chip signs each tap once, so it cannot be photographed, forwarded or replayed. And the tap only counts inside the tapping person’s own signed-in session on their own phone. Clocking a colleague in now requires physically holding their unlocked phone at the door — no longer a favour, but a deliberate, visible act with their full cooperation, equivalent to forging a signed timesheet. Culture handles what remains, because the easy lie is gone.
Asked in every evaluation
Can’t someone just hand their phone over?
Physically, yes — deliberately, visibly, with their own unlocked phone at the door. The point is not to make dishonesty impossible; it is to remove the casual, deniable version of it. Deliberate collusion is a conduct matter, and the record shows exactly whose session tapped.
Is a photo of the reader really useless?
Completely. The chip generates a fresh one-time signature per tap; a photo carries no chip and no signature. Even a captured link from a real tap dies the moment it is used once.
What does lateness look like once records are honest?
Visible — which is the point. Managers see actual arrival patterns instead of rounded guesses, and the conversation moves from suspicion to fact.
Honest records, no scanners
One flat price per organisation. Readers arrive pre-programmed — peel, stick, tap.
See pricing