Buddy Punching: Badges to Biometrics

Steve Hale
Principal Engineer, Time and Attendance Lead

Anyone supervising hourly employees would be familiar with “Buddy Punching,” one employee punching in or out on behalf of a co-worker allowing them to arrive late, leave early, or even be absent for a shift while getting paid for that time away from work. There is also an unintentional form of this where an employee accidentally types an incorrect ID that happens to match someone else, causing a missed punch for the person at the timeclock and an errant punch for the matching employee.

Employers can combat these issues in different ways, each having different costs and degrees of success:

  • Replacing keypresses with assigned badges (or fobs) eliminates unintentional Buddy Punching, and can provide some relief against the intentional kind, particularly when those badges are to be worn as identification and not stored together in a rack near the timeclock. However, in addition to the material cost of a badge management system, supervisors must also deal with forgotten or misplaced badges causing lost productivity.
  • Entry of a Personal Identification Number (PIN) to authenticate an employee ID is a low-cost approach to help eliminate mistyped ID numbers, but does very little to combat intentional Buddy Punching since complicit employees would be just as willing to share their PINs with each other as they would share their employee IDs or badges.
  • Biometric authentication ensures the person performing the punch at the timeclock is indeed the person matching the employee or badge ID. By far the most common biometric authentication method uses fingerprint comparison. The employee is asked to place a finger on a sensor which captures a fingerprint then converts it into a digital template to be compared against previously enrolled master templates for that employee. Hand geometry, finger vein patterns, palm vein patterns, and even iris or retinal scans are examples of other biometric formats, each providing different degrees of uniqueness and associated costs. Such systems can be expensive to initially deploy, and maintenance involves enrolling new hires, periodically cleaning the sensor, and handling specific employees whose physiology generates poor templates and/or who individually object to fingerprint capture and storage. In fact, several U.S. states (Illinois, Texas and Washington) have enacted legislation governing commercial use of biometrics, requiring written employee consent as well as imposing strict data security and retention policies upon employers.
  • Video Surveillance may just be the most cost-effective way to manage intentional Buddy Punching, particularly if the timeclock can be placed in an area that is already covered by existing security equipment. Captured video can be reviewed in specific instances where intentional Buddy Punching is suspected. Generally, cameras cannot be placed where employees have a reasonable expectation of privacy, and employees must be notified of the surveillance, yet that can be a very strong deterrent just by itself.

Deciding which approach is best for your company depends on many factors, but a reasonable low-cost low-maintenance arrangement could include keypad entry of the employee ID followed by PIN entry to validate that ID, combined with a rather conspicuous warning about video surveillance (real or imaginary) would effectively reduce both unintentional and intentional Buddy Punching.