How does time and attendance software track hours and stop time theft / buddy punching?

A time and attendance system stores a timestamped punch event and applies pay rules to the interval between punches, so payroll and any later auditor read the same numbers. A complete punch record carries the employee identifier, the timestamp, the capture method, and the submitting device.

Where punches come from

Most employers run two or three clock-in surfaces at once. A browser session covers office staff, a mobile app covers field crews moving between sites, and a shared tablet in kiosk mode covers hourly teams without a work phone. A wall-mounted terminal with a badge reader, PIN pad, or biometric sensor covers factory, warehouse, and hospital floors where personal phones are prohibited.

From punch to paycheck

The rules engine turns raw intervals into paid time by matching punches against a schedule, applying any rounding policy, handling meal breaks, and calculating overtime against the defined workweek. Federal recordkeeping regulations require the employer to preserve hours worked each workday and total hours worked each workweek, plus the time of day and day of the week the workweek begins [10].

The audit trail

A usable audit trail keeps the original value, the changed value, who changed it, when, and a reason code, and it lets employees see edits to their own records. Because the recordkeeping duty sits with the employer [10], an unexplained gap tends to be read against the employer.

Each control has a specific failure mode, and knowing which one you are accepting matters more than the vendor feature list.

Credential methods: PIN, badge, and device binding

A PIN or a badge authenticates an account rather than a person, so neither stops a coworker who was told the number or handed the card. Binding punches to a registered device or an approved IP range removes the case where somebody clocks a friend in from home, and it leaves the on-site version untouched.

Location methods: GPS and geofencing

A geofence confirms that a phone crossed into a radius around a jobsite, which is useful for dispersed crews and useless as an identity check [14]. Consumer GPS degrades indoors and inside steel structures, so a tight radius rejects punches from employees standing where they should be. Draw the radius against the real footprint of the site.

Image capture: photo on punch

A photo taken at the punch is a deterrent and an evidence trail rather than a gate, because the punch still records and somebody has to review the images for the control to do anything [14]. That review burden is why the feature quietly stops working after a few months.

Biometric methods: fingerprint and face

Fingerprint and facial verification are the only methods that test the person instead of the credential, which is also why they attract statutory duties the others avoid. They fail unevenly. NIST's evaluation of face recognition algorithms found false positive rates varying across demographic groups by factors of ten to beyond one hundred, with elevated false positives in women, in the elderly, and in children [13]. Worn fingertips produce repeated rejections in manual trades, and every refused punch pushes a worker into a manual exception process, so build that fallback first.

Offline capture and clock integrity

Offline capture stores punches locally and syncs them when connectivity returns. Ask whether the timestamp comes from the device or the server, because a device-set timestamp on a phone whose clock the user controls is a weaker record [10].

In Illinois, written notice and a signed written release must come before the first scan. The Biometric Information Privacy Act defines a biometric identifier as a retina or iris scan, a fingerprint, a voiceprint, or a scan of hand or face geometry, and it excludes photographs and written signatures [1]. Section 15(b) bars collection unless the entity first informs the person in writing that the identifier is being collected and stored, informs them in writing of the specific purpose and length of term, and receives a written release. In employment that release is one executed as a condition of employment, and a 2024 amendment confirmed an electronic signature qualifies [1]. Section 15(a) also requires a public retention policy with destruction when the purpose is satisfied or within three years of the last interaction [1].

Why Illinois dominates the risk

Illinois is the state that lets employees sue. Section 20 gives an aggrieved person liquidated damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys' fees and costs [1]. In Cothron v. White Castle System the Illinois Supreme Court held that a separate claim accrues each time an entity scans or transmits an identifier in violation of the statute, not only on the first scan; the opinion records the employer's estimate that class-wide damages across roughly 9,500 employees could exceed $17 billion [2]. Public Act 103-769, effective August 2, 2024, narrowed that accrual so repeated collection of the same identifier from the same person by the same method is a single violation with at most one recovery [1].

Texas and Washington

Texas prohibits capturing a biometric identifier for a commercial purpose without informing the individual and obtaining consent first, and requires destruction no later than one year after the purpose expires. Only its attorney general may enforce that, with civil penalties up to $25,000 per violation [3]. Washington requires notice, consent, or a mechanism to prevent later commercial use before a biometric identifier is enrolled commercially, again enforceable solely by the attorney general [4]. Both remove the class action pressure that drives Illinois exposure. This is general information about published law, not legal advice.

Federal regulations do not require a time clock, but they do require accurate records of hours worked and they constrain what you may do to the numbers. Employees who punch in early or out late without performing work may have that punching disregarded [5]. Rounding start and stop times to the nearest five minutes, tenth of an hour, or quarter hour is accepted, provided it averages out so employees are fully compensated for the hours actually worked [5]. A rounding rule that only ever moves in the employer's direction is the version that creates liability.

De minimis is narrower than employers assume

Federal regulation allows insubstantial fragments to be disregarded only where the periods are uncertain and indefinite and last a few seconds or minutes, and it bars an employer from arbitrarily failing to count practically ascertainable time an employee regularly spends on assigned duties [6]. State law can be stricter. In Troester v. Starbucks, decided July 26, 2018, the California Supreme Court held that California wage law has not adopted the federal de minimis doctrine and did not permit applying one where an employer required several minutes of off-the-clock work per shift [7].

Off-the-clock work and the duty to police it

Work an employer suffers or permits is work time, and a written rule against unrecorded work does not discharge the obligation. The regulation states that mere promulgation of a rule against such work is not enough and that management must make every effort to enforce it [8].

Automatic meal deductions are the common failure point

A meal period is unpaid only where the employee is completely relieved from duty, and an employee required to perform any duties while eating, active or inactive, is working [9]. An automatic deduction runs whether or not the break happened, which is how a setting meant to save administrative effort becomes a wage claim. The safer configuration requires a break punch or a one-tap cancellation, plus a report on employees whose deductions are never cancelled [10].

The legally meaningful distinction is between capturing a location at the moment of a punch and tracking a person continuously. California prohibits any person or entity in the state from using an electronic tracking device to determine the location or movement of a person, defining that device as one attached to a vehicle or other movable thing that reveals location through electronic signals, and exempting cases where the vehicle's registered owner, lessor, or lessee consented [11]. A tracker fitted to an employee's car without consent is the clearest problem.

Notice statutes reach further. Connecticut requires an employer engaged in any electronic monitoring to give prior written notice describing the types of monitoring that may occur, satisfied by a conspicuous posting, with an exception where the employer has reasonable grounds to believe employees are engaged in unlawful conduct. Its Labor Commissioner may levy penalties up to $500 for a first offense, $1,000 for a second, and $3,000 for each subsequent offense [12]. Other states set their own rules.

A defensible setup captures coordinates only on punch events and geofence transitions, disables background collection outside scheduled shifts, states the retention period in the employee notice, and limits who can view location history. None of this is legal advice.

The phrase "time theft" is employer and vendor language covering behavior that ranges from outright fraud to a two-minute discrepancy, and the same tools, described neutrally, are systems for location capture, image capture, and behavioral logging of workers. Reading only the first description is how organizations buy more monitoring than the problem justifies.

The loss figures are mostly unsourced

Numbers circulating about what buddy punching costs employers each year generally originate in vendor marketing and cannot be traced to a study with a documented method. Measure your own exposure first by comparing scheduled hours against paid hours by site and by supervisor.

Error rates land unevenly

A face matching threshold tuned for convenience produces different error rates for different groups of employees [13], and the person whose punch is refused absorbs the cost in delayed starts and manual corrections. Any biometric rollout needs a documented alternative for people the sensor fails and for those who decline.

The audit trail cuts both directions

The same edit log that shows an employee punching in eleven minutes early also shows a manager deleting punches at month end. Requiring a reason code on every edit and showing edits to the employee costs nothing.

Collective bargaining agreements frequently cover timekeeping changes, and works councils outside the United States generally must be consulted first.

It is not payroll software

Time and attendance produces the hours; payroll applies rates, taxes, and deductions to them. Many suites include both, and plenty of employers export into a separate payroll system.

It is not scheduling software

Scheduling decides who is supposed to work; time and attendance records who actually did. Predictive scheduling ordinances create obligations a timekeeping product does not cover.

It is not employee monitoring software

Keystroke logging, screenshot capture, and application usage tracking form a separate category with separate notice obligations. Some time products bundle them, which is worth checking during procurement, because the notice rules for electronic monitoring are broader [12].

It is not proof that hours are complete

A clean punch record is evidence, not a defense. Work the employer knew about or permitted counts as hours worked even when it never reached the clock, and a written policy against unrecorded work does not by itself satisfy that duty [8].

It is not a compliance product

Software produces records and enforces the configuration you give it. Whether your rounding rule, automatic meal deduction, or biometric consent form is lawful in a given state is a question for counsel, not a setting in an admin menu.