Buddy punching: how proxy attendance happens and how to stop it

Buddy punching is when one employee marks attendance for another who is late or absent. It is also called proxy attendance. On a shop floor it usually costs a few minutes here and a missed half day there, but because wages and overtime are calculated from attendance, every proxy punch turns into money paid for work that didn't happen.

How proxy attendance happens

Most of it isn't elaborate. These are the patterns HR teams describe most often:

• The register or muster roll. A supervisor or a colleague writes in a time for someone who hasn't arrived yet. Nobody checks the handwriting.
• Shared cards. RFID and swipe cards can be handed to a friend at the gate.
• Shared logins. In app-based attendance with only a password or OTP, one person can sign in on several phones, or keep a colleague's account open on their own phone.
• Photos instead of faces. A selfie check without a liveness test accepts a photo of the employee held up to the camera.
• Punching from somewhere else. Without a location check, an employee can check in from home or the tea stall outside the gate.

Fingerprint machines stop some of this, but they bring their own problems: queues at shift change, fingers that don't read after manual work, devices that break, and no help at all for staff who work at a client site or in the field.

Five checks that make a punch hard to fake

A punch is trustworthy when it answers three questions: is this the right person, on their own device, at the right place? These five checks cover all three.

1. One registered phone per employee

The employee signs in once and the phone is bound to their account. A second phone cannot sign in until HR deliberately resets the first one. This alone ends shared logins, because sharing an account means handing over the phone.

2. A fresh, signed challenge for every punch

Each punch should sign a one-time challenge from the server with a key that lives inside the phone's secure hardware. In PunchMe the challenge expires in 60 seconds and works once, so a recorded punch can't be replayed later.

3. Liveness with random steps

A face check only stops photos if it asks for something a photo can't do. Asking for two random actions per punch, such as "blink, then turn left", defeats printed photos and most replayed videos, because the person holding them doesn't know which steps will come.

4. Face matched on the server, not only on the phone

If the match happens only on the device, a modified app can claim it passed. Matching against the employee's enrolled template on the server keeps the decision out of the phone's hands.

5. Geofence and mock-location checks

Each office gets a radius or a drawn boundary. Check-ins from outside are blocked or sent to HR for review. Android reports when a location comes from a mock-location app, and that flag should travel with the punch.

Decide what a failed check does

Not every failed check means fraud. GPS drifts indoors, a new employee's face template may need re-enrolment, and network drops happen at remote sites. A good rule of thumb:

Review queues matter more than rules. If HR sees flagged punches the same day, with the distance from the office and the face score, decisions take seconds instead of turning into month-end arguments.

Where to start

Pick one site, turn on device binding and the geofence first, and run it for two weeks alongside your current system. Compare the two. Most teams find the gap in the first week, and it is usually concentrated in a few shifts or a few supervisors.

PunchMe runs all five checks on every punch and lets you choose block, review or allow for each one. See how punches are checked or start a free trial.