What buddy punching costs schools, and 5 ways to stop it
Buddy punching is when one person clocks in for somebody who isn’t there yet. Most people who have worked an hourly job have either done it or had it done for them.
In an office it’s a payroll problem: you pay for time nobody worked. In a school it’s a different problem, and the usual framing gets it slightly wrong, so it’s worth being precise.
An aide is running ten minutes late for a 7am breakfast program. A colleague already in the building clocks her in.
The clock-in didn’t make her late. She was going to be late either way. What it did was make the lateness invisible. For those ten minutes the record shows two adults covering the room when there is one, and nobody who could send help knows there’s a reason to.
Do that a few times a week, across a few sites, and your staffing records stop describing the building.
Why this lands differently in a school
Every other article on this subject is written for a finance director. It will tell you buddy punching is time theft, that it costs some percentage of gross payroll, and that you should buy a fingerprint reader.
That’s all true, and it’s not the part that matters here. In an office, someone clocked in but absent costs you their hourly rate. In a school, the same record means your coverage data is wrong, and coverage is the thing you make promises about to parents, to licensing, and sometimes to the state.
Buddy punching doesn’t create a staffing gap. It hides one, which is worse, because a gap you know about gets covered.
That’s the whole argument. A late aide is a normal Tuesday and somebody reshuffles. A late aide who shows as present is a room nobody is worried about.
The words, quickly, because they get muddled
You’ll meet several terms and they don’t mean the same thing:
- Buddy punching is one person clocking in or out for another who isn’t there.
- Time theft is the broader category of being paid for time not worked, including long breaks and leaving early.
- Timesheet fraud and time clock fraud are the same idea with the paperwork emphasized.
- Payroll fraud is the umbrella, and it includes the serious version, ghost employees, where someone on the payroll doesn’t work there at all.
Buddy punching is the mildest thing on that list and the one that makes the rest thinkable, because a building where clocking in a friend is routine is a building where the record is understood to be approximate.
What it actually looks like, by setting
The morning shift in a K-12 school
This is where it lives. Breakfast programs, bus routes, custodial openers, crossing duty. Shifts that start before any administrator is in the building, at a door nobody is watching, for staff paid by the hour.
Schools usually have tight control over the student register, because it’s regulated and somebody inspects it. The staff entrance at quarter to seven has no equivalent. It’s the same act, with more consequence, and less oversight.
The classroom, where students do the same thing
Worth naming, because it’s the identical failure with a different cast. One student marks four friends present. The roll says thirty, the room holds twenty-six.
Teachers know this happens and mostly tolerate it in younger years, where it’s rare and harmless. From middle school up it’s routine enough that proxy check-ins are their own problem to solve, separate from getting the roll taken at all.
After-school and summer programs
The highest exposure of the three, and the least administrative cover. Staff are part-time, often young, frequently at a site the organization doesn’t own. The person in charge is usually also the person running the activity.
And the hours are evidence. When a program is funded on staff hours delivered, a timesheet nobody can vouch for isn’t a payroll question, it’s the thing an auditor asks about first.
Universities and colleges
Both versions, at scale. Student workers in libraries, labs, dining halls and events are a large hourly workforce spread across buildings nobody supervises centrally. And in the lecture hall, attendance records now feed financial aid compliance, so a roll that can’t be trusted stops being an academic irritation and becomes a Title IV exposure.
The four things it actually costs you
1. A supervision ratio that isn’t real
This is the one. Your ratio is a promise to parents, often a licensing condition, and occasionally a legal requirement. It is calculated from who is present.
When the record says present and the person is in traffic, the only people who know are the two staff who covered for each other. You can reshuffle a room you know is short. You cannot reshuffle one that looks fine on a screen.
2. A roll call that’s missing someone
When the alarm goes and everybody is in the parking lot, the list you’re counting against includes an adult who isn’t on site. You’ll spend the drill looking for them.
The reverse is worse and rarer: somebody who slipped in without clocking, who nobody is looking for.
3. Hours a funder will eventually ask about
Grant-funded programs get audited on hours delivered. So do some state-funded after-school and summer programs. The question is never “did this happen”, it’s “show me”. A record that can’t distinguish between a real arrival and a favour cannot answer that.
4. The staff who don’t do it
The quietest cost and the one that lasts. In any building where this is tolerated, the people who show up on time know exactly who doesn’t, and know that management either hasn’t noticed or has decided not to.
That’s corrosive in a way no control fixes afterwards. It’s the strongest argument for dealing with it early and lightly rather than late and formally.
The money, for completeness
You’ll see three figures quoted everywhere: buddy punching costs US employers $373 million a year, affects 75% of businesses, and accounts for 2.2% of gross payroll. Before you put those in a board paper, know that almost every page carrying them is published by a company selling time-tracking software, and the underlying studies are old and hard to find.
The more defensible data comes from the Association of Certified Fraud Examiners, whose 2024 report found payroll fraud made up 10% of occupational fraud cases at a median loss of $50,000, and that the education sector’s median loss was $50,000, among the lowest of any industry.
But the number that should get your attention isn’t a dollar figure. It’s that the typical scheme ran 12 months before anyone noticed, and that 43% of frauds were caught by a tip rather than by any control, with employees supplying more than half of those tips.
A year. And when it did surface, it was because a person decided to say something.
5 ways to stop it
None of these require buying anything, and the order matters. Most schools fix this with the first two.
1. Move the check-in to where the work is
Most buddy punching is possible because the check-in isn’t tied to a place. A PIN on a shared tablet, or an app on a phone, works identically from the staff room and from a kitchen table.
Tie it to the site. A code that only works inside a geofence, or a screen physically mounted at the entrance staff walk through, removes the remote version completely. It won’t stop somebody already in the building clocking in a colleague, which is why it isn’t enough on its own, but it’s the cheapest single improvement available.
2. Make the record show who, not just when
A photo captured at the moment of check-in is the control that actually works, and it works for a social reason rather than a technical one. Clocking in a friend stops being a favour the second it involves photographing yourself doing it.
One check-in per person per session, tied to the device it came from, closes the rest. Two taps thirty seconds apart from one phone is a pattern, and a pattern can be surfaced without anybody being accused of anything.
3. Keep the method on the record, not just the time
A line that says 6:52 tells you nothing about whether 6:52 is true. A line that says 6:52, on site, own device, photo captured is a different thing entirely.
It also changes how the conversation goes. You’re not accusing anybody of anything. You’re showing them a row with a gap in it and asking what happened, which is a far easier thing to do on a Tuesday morning.
4. Write it down before you need it
Most schools have no time theft policy, so the first time anyone defines this is the day it becomes a problem with a named person attached. That’s the worst possible moment.
A usable one is three sentences. Clocking in for another person is misconduct. It applies equally to the person who asked and the person who did it. Here is what happens.
Staff do ask whether someone can be dismissed for clocking a colleague in. In most US states employment is at-will and falsifying a time record is generally treated as serious misconduct, so the honest answer is yes. Much better that it’s written in a handbook in August than explained in an office in February.
5. Look at the exceptions, never the totals
Nobody has time to review forty timesheets a week, and reviewing totals catches nothing, because a buddy-punched shift looks exactly like a worked one.
Look at anomalies instead. It’s a five minute job if the system surfaces them:
- Two check-ins within a minute of each other from one device
- Shifts with no check-out at all
- An arrival time that’s identical every day, to the minute
- Check-ins from outside the site
Keep in mind that most of these get found by people rather than systems. The purpose of a visible control isn’t to catch anybody. It’s to make it obvious that a record exists, so the favour stops being asked for.
Two things to be careful with
Biometrics. Fingerprint and face clocks are marketed hard as the solution here, and technically they do solve it. They also put you inside biometric privacy law. Illinois’ Biometric Information Privacy Act requires written consent before you collect biometric identifiers and lets individuals sue; Texas and Washington have their own statutes. Several US districts have pulled fingerprint systems out after objections from parents and unions. If you’re going that way, bring counsel in first rather than after.
Student data. A system recording staff arrivals is a low-risk purchase. The same system holding student records sits under FERPA and your district’s agreements, and becomes a full procurement review. Knowing which one you’re actually buying can save a semester.
What to do on Monday
If you want to act on one thing from this, make it this: walk to the door your earliest shift uses and ask yourself how somebody would clock in a colleague from there.
If the answer is quick and obvious, you’ve found the control you need, and it’s almost certainly location or a photo rather than anything expensive.
Then, in order:
- Write the three sentence policy and put it in the handbook
- Say it out loud once, to everyone, without naming anyone. This alone ends most of it
- Pick one anomaly to look at weekly. Two check-ins from one device is the best first choice
- Only then consider whether you need different software
Most schools that deal with this properly never get past step two, because the problem was never really about enforcement. It was that nobody had ever said the thing out loud.
Where OneTap fits
We make one of the tools in this space, so briefly and honestly.
OneTap is a check-in and attendance record. It covers the part above that’s about knowing an arrival was real: check-in by QR code, iPad kiosk or personal code, with location restriction, one check-in per person per session, and photo or signature capture on the record. Check-out gives you time on site, and the export goes to whatever runs your payroll.
The same system covers staff check-in and classroom attendance, which is useful in a school where those are currently two unrelated processes with two different answers to “who is here”.
What it isn’t: a time clock with pay rules or overtime calculation, and it doesn’t do biometrics. If you need those, you want a workforce management platform, and we’d be the wrong thing to buy.
Common questions
What is buddy punching?
One employee clocking in or out for a colleague who isn’t there, so the record shows hours nobody worked. In a school the more important effect is that the supervision ratio on paper doesn’t match the ratio in the room.
Is buddy punching illegal?
It’s payroll fraud, and depending on scale it can be treated as theft. In practice almost every school handles it as a disciplinary matter under a time theft policy rather than a criminal one.
Can someone be fired for clocking a colleague in?
Yes. In most US states employment is at-will and falsifying a time record is generally treated as serious misconduct. The person who asked is usually treated the same as the person who did it.
How do you prevent buddy punching without biometrics?
Location restriction, one check-in per person per session tied to a device, and a photo captured at check-in. Together those cover the remote case, the repeat case and the identity case without collecting biometric identifiers or triggering state biometric privacy law.
Does this apply to students as well as staff?
The same failure, yes, though the fix differs. For students it’s codes that only work in that room during that period and one check-in per person, rather than photographs.
What is the difference between buddy punching and ghost employees?
Buddy punching inflates a real employee’s hours. A ghost employee is someone on payroll who doesn’t work there or doesn’t exist. The second is rarer, far more costly, and usually needs somebody in payroll to be involved.