How to Prevent Buddy Punching: A System Fix, Not a Trust Problem
It's 7:58am on a Saturday. You're unlocking the back door of the FEC, party bookings start at 9, and one of your two openers — call her Mia — is meant to be on the floor at 8:00 sharp. Your phone buzzes. It's not Mia. It's Jordan, the other opener, already inside: "Mia says can you clock her in, she's two minutes away, parking." You haven't poured coffee yet. You tap the shared iPad on the counter, type Mia's PIN, done. Mia rolls in at 8:11. The timesheet says 8:00.
That's buddy punching. And it happened before you'd taken your jacket off.
What buddy punching actually is (and why it keeps happening)
Buddy punching is one employee clocking in — or out — on behalf of another. Sometimes it covers a few minutes of lateness. Sometimes it covers a no-show for a whole opening hour. Sometimes it's more deliberate: two mates padding each other's hours across a fortnight.
Here's the thing operators miss: it's rarely a character flaw. It's a predictable response to a clock-in system that has no idea who is standing in front of it. If the "verification" is a four-digit PIN that everyone on the roster knows, or a paper sheet on a clipboard, or an app anyone can tap on a shared tablet — you haven't created a security gap. You've created an invitation. A polite one, even. The system is literally asking, "are you Mia?" and accepting the answer "sure".
The staff who show up on time notice this, by the way. That's the part that stings.
What it costs — run the numbers
Operators are usually shocked when they actually do the arithmetic, so let's do it, not talk around it.
Take a modest case. One casual gets clocked in 15 minutes early three shifts a week. Just 15 minutes. That's 45 minutes a week of phantom labour per person. Do it across two staff and you're at 90 minutes a week — an hour and a half you're paying for that nobody worked.
Australian venue, General Retail Award Saturday rate. Casual base plus casual loading plus Saturday penalty lands somewhere around $41–$43/hour for an adult Level 1 in 2024 (check your exact rate on the award rates calculator). At $42/hour × 1.5 hours/week × 52 weeks = $3,276 a year. For 15 minutes, three times a week, across two staff. If it's happening on Sundays too, double it.
US store, someone earning $15/hour. 1.5 hours/week × 52 weeks × $15 = $1,170 a year. Two staff doing it modestly. Now imagine one of them is closing too, and adds a "forgot to clock out" 15 minutes at the end of the shift. You're at $2,340 without breaking a sweat.
None of these numbers include the payroll tax, super/benefits, or the fact that once one person does it and gets away with it, the practice spreads. In an FEC or trampoline park with 25 casuals rotating through, the ceiling on this is genuinely a five-figure annual leak.
That's a full POS upgrade. That's a birthday-party marketing campaign. That's a bonus for the staff who actually turn up at 8am.
Why the usual fixes don't fix it (PIN, paper, policy)
Most operators try the same three things, in the same order, with the same result.
PIN codes on a shared device. A PIN is not identity verification. It's a shared password that migrates around the team by lunchtime on someone's first shift. If Jordan can type Mia's PIN, the PIN has done nothing.
Paper sign-in sheets. These work in theory because a signature is unique. In practice, nobody countersigns in real time. You reconcile them on Sunday night, by which point the memory of who was actually there at 8:03 vs 8:11 is gone. And the person filling it in is often… the person being paid.
Manager sign-off. Great, except you're not there at 8am Saturday. You're at the wholesaler, or you're sleeping because you closed at 11. The whole reason those openers exist is that you can't be at the door for every shift.
Honour policies and "we've talked about it" memos. These hold up beautifully until someone's late and their friend is standing next to the clock. Policy relies on the moment of decision being difficult. Buddy punching, in a PIN or app-tap system, is easier than being on time. That's a losing matchup for any policy.
The pattern here: every one of these "fixes" leaves the actual gap — no verification of the physical person — completely open.
What a biometric time clock changes
A biometric time clock ties the clock-in to something that can't be texted to a colleague from a car park: a fingerprint, or a face. Mia can't ask Jordan to be her thumb. That's it. That's the whole mechanism.
I want to be careful with the framing here, because operators sometimes flinch at the word biometric — it sounds like surveillance. It isn't. You're not tracking anyone's movements. You're not reading anyone's biology beyond a one-time match at the moment of clock-in. What you're doing is closing a system flaw that wasn't fair to anyone — least of all the staff who show up on time and watch a colleague get paid for hours they didn't work.
The other thing worth saying plainly: it removes the awkward conversation. Nobody has to accuse anyone of anything. The clock just… only works for the person standing in front of it. Temptation gone, ambiguity gone. Jordan never gets that 7:58am text in the first place, because Mia knows it won't work.
At Schedaddle, this is built in — the biometric verification lives inside the clock-in on the staff's own phone, geofenced to the venue so it only registers when they're actually on site. Not a separate hardware kiosk, not a bolt-on. You can see the full feature list if you want the specifics of how it works.
The roster link that makes it real
Here's the part most operators underestimate. A biometric clock, on its own, still leaves you with two systems to reconcile: the roster you built on Monday, and the clock-in log you inherit on Sunday.
The value shows up when the clock feeds back into the published roster in real time. You open your phone at 8:05 Saturday and see: rostered — Mia 8:00, Jordan 8:00. Actual — Jordan clocked in 7:56, Mia not yet on site. No spreadsheet reconciliation. No end-of-week detective work. You know the gap in the moment it happens, which means you can text Mia while she's still in the car park instead of finding out on payroll day.
That's the loop that matters: rostered vs. actually here, visible on one screen, from a clock that can't be spoofed. Take away either half — biometric-but-disconnected, or connected-but-tap-anywhere — and you're back to guessing.
If your current setup makes buddy punching easier than showing up on time, the problem isn't your staff. It's the system you handed them. Fixing the system is cheaper than the leak, and — this is the part I didn't expect when I first sat with operators on it — the honest staff notice. They notice it stopped being possible for the person next to them to game the clock. That's a culture shift you can't get from a policy memo.
So the question I'd actually sit with, if I were running your Saturday open next week: what does your clock-in data actually tell you right now — and would it survive a look?