How to Prevent Buddy Punching Without Biometrics

What buddy punching costs you

Buddy-punching is when one employee clocks in for another. It can look small one shift at a time, but it adds up when employees can punch from the wrong place, the wrong device, or for someone who is late or absent. You can catch most of it without using fingerprints or face recognition: photo-on-punch for human review, GPS-bounded clock-in, device-ID, and pattern alerts.

A fingerprint reader in Illinois requires written notice, written consent, a retention policy, and a destruction protocol under state law. A photo-on-punch with GPS and device-ID usually gives you the evidence you need without putting every clock-in inside a biometric privacy statute.

Use lower-risk proof first

• Use photo + GPS clock-in instead of fingerprint or face-recognition unless you have a strong reason to use biometrics.
• Look for patterns: same-second punches, same IP, impossible distances.
• Investigate before firing — review photos, GPS, and access logs.
• Pay any disputed wages at termination, then pursue recovery separately.
• If you're in Illinois or Texas and want fingerprint/face — talk to a lawyer first.

Where biometric time clocks create extra risk

• Deploying a fingerprint timeclock in Illinois without written notice and consent — that's $1,000–$5,000 per employee, plus lawyer fees.
• Thinking Texas is risk-free because employees cannot file BIPA-style private lawsuits — the Texas Attorney General can still enforce the biometric law.
• Firing the employee for buddy-punching without paying their disputed wages — California adds 30 days of penalties.
• Running facial-recognition matching on photos in Illinois — that crosses from photo (safe) to biometric (regulated).

Use non-biometric detection first

Photo + GPS + device-ID catches the common buddy-punching patterns and gives you a record to review when a punch looks wrong. Start with the least invasive system that gives you enough proof. Pick the technology that solves the payroll problem without creating a bigger privacy problem.