"He was here, I saw his truck." Most superintendents have heard some version of that line when a time entry looks wrong. Sometimes it is true. Sometimes the truck was there because a coworker drove it, and the worker it belongs to was on another job, at a doctor's appointment, or still at home. The hours still went on the timesheet, and the company still paid for them.
That is buddy punching: one worker clocking in or signing in for another. On construction sites it rarely looks like fraud. It usually looks like a favor: "Sign me in, I'm parking." But a small favor repeated across crews and projects adds up to real labor cost, inaccurate job costing, and, in the worst case, a safety problem when your headcount says someone is on site and they are not.
The short answer: buddy punching happens in construction when the check-in method does not prove who is physically present, for example sign-in sheets, shared PINs, or badges that can be handed over. You stop it by verifying identity at the point of check-in (facial recognition or supervised photo capture), by making the check-in happen at a single controlled point like the site gate, and by reviewing exceptions instead of trusting totals.
What buddy punching looks like on a jobsite
It is worth being specific, because the fix depends on how it happens on your projects:
- The clipboard signature. A worker writes a friend's name on the paper sign-in sheet along with their own.
- The handed-over badge or card. A worker scans their own card and a coworker's on the way in.
- The shared phone. A foreman or worker clocks in several people from one phone app.
- The late arrival covered. Someone arrives 45 minutes late, but a coworker clocked them in at the normal start time.
- The early departure covered. A worker leaves at 2 p.m., and someone else clocks them out at 3:30.
- The ghost worker. Rarer, but serious: hours recorded for someone who did not work on that project at all.
Only the last one is clearly deliberate fraud. The others are often treated as normal crew behavior, which is exactly why they persist.
What buddy punching really costs
You will see many industry statistics quoted about time theft. Rather than borrow someone else's number, estimate your own exposure. It takes about ten minutes.
A worked example
For example, say a project has 80 workers on site across your crews and subcontractors. Suppose that on an average day, 5 workers have 30 minutes of time recorded that they did not actually work (late arrivals covered, early departures covered).
- 5 workers x 0.5 hours = 2.5 paid hours per day that were not worked
- 2.5 hours x $55 loaded labor rate = $137.50 per day
- $137.50 x 5 days = $687.50 per week
- $687.50 x 50 working weeks = $34,375 per year, on one project
Change the inputs to match your projects. Even small numbers multiply quickly across a portfolio. And this only counts direct wages for your own crews; it does not include the downstream effects.
The hidden costs
- Wrong job costing. Inflated hours on one project make the next estimate look worse than it should, or hide a productivity problem.
- Inaccurate subcontractor billing. On time-and-material or cost-plus work, padded subcontractor hours flow straight into what you pay or bill. We cover this in how to verify subcontractor headcount and hours.
- Bad manpower logs. Daily logs built from sign-in sheets carry the same errors into Procore or your project records.
- Safety and emergency response. If an evacuation headcount relies on sign-in records, a worker who is "signed in" but not on site sends people looking for someone who is not there. Worse, someone on site who never signed in is missing from the list.
- Morale. The workers who show up on time notice when others do not, and nothing happens.
Why the usual fixes do not work
| Common fix | Why it falls short |
|---|---|
| Supervisor watches the sign-in sheet | The superintendent has better things to do at 6:45 a.m., and cannot watch every entrance. |
| PIN codes | PINs are shared within a week. They prove someone knows a number, not who they are. |
| Badges or cards alone | Fast and practical, but a card can be handed to a friend. |
| GPS on personal phones | Proves where a phone is, not who is holding it. Also raises privacy concerns with workers. |
| Policy memos and warnings | Helpful for setting expectations, but without verification they are hard to enforce. |
Badges, cards, and QR codes are still useful. They are fast and they work well when combined with something that confirms the person.
How to stop buddy punching: a step-by-step approach
Step 1: Make one place the official check-in
Choose the gate or main entrance on each project and make check-in at that point a condition of site access. A single controlled point is far easier to verify than a phone app that can be used from the parking lot or from home.
Step 2: Add identity verification where the risk justifies it
Not every site needs the same level of control. A small residential job with one crew you know well may only need QR or card check-in. A large commercial site with many subcontractors benefits from stronger verification:
- Facial recognition confirms that the person checking in is the enrolled worker. It is the strongest practical defense against buddy punching, but it involves biometric data, so consent and retention rules apply. Read our guide to facial recognition time clocks and biometric privacy before you turn it on.
- Photo on check-in captures an image with each punch that a supervisor can review. It does not block buddy punching in the moment, but it makes it visible and discourages it.
Step 3: Use spot checks
A spot check is simple: a supervisor walks the site with a list of who is checked in and confirms people are actually there. Random spot checks, recorded in the system, catch both buddy punching and workers who forgot to check out.
Step 4: Compare check-ins with expected attendance
If you know which workers are expected on which project, you can flag mismatches automatically: someone expected who never checked in, or someone checked in on two projects at once. An exception list is much easier to review than a full timesheet.
Step 5: Review exceptions weekly, not just totals
Totals hide problems. Look at patterns: the same worker checking in at exactly the same minute as another every day, check-ins right after the start time followed by no activity, or manual edits made by the same person repeatedly. An audit trail of who edited which entries makes this review possible.
Step 6: Explain it to the crews
Tell workers why you are changing the process. Frame it around fairness and safety: accurate hours for the people who show up, and an accurate list of who is on site if there is an emergency. Most crews accept verification once they understand it applies to everyone, including subcontractors.
A quick buddy punching risk checklist
- Do workers sign in on paper or with a shared device anywhere on your projects?
- Can one person check in several others?
- Can workers check in from somewhere other than the site entrance?
- Do you ever see identical check-in times for several workers in a row?
- Do manual time edits happen without a record of who made them?
- Do your emergency headcounts come from the same records as payroll?
- Have you ever compared a sign-in sheet against an actual walk of the site?
If you answered yes to the first three or no to the last, there is a good chance buddy punching is happening on at least some of your jobs.
Matching the control to the project
A practical way to decide how much verification a project needs:
| Project profile | Suggested approach |
|---|---|
| Small crew, one trade, workers you know well | QR code or access card check-in at the gate, with occasional spot checks. |
| Mid-size project, several subcontractors | Gate kiosk with cards or helmet stickers, presence alerts for expected workers, weekly exception review. |
| Large or high-security site, many subs, T&M work | Facial recognition at the gate (with consent), card as fallback, regular spot checks, strict edit permissions. |
| Owner or union restricts biometrics | Cards or stickers plus photo review and spot checks. |
You do not need the strongest option everywhere. You need enough verification that a covered late arrival is the exception rather than the habit.
What about privacy and worker trust?
Verification only works if workers accept it. A few practices help:
- Be clear about what data you collect and why. Put it in writing.
- If you use facial recognition, get written consent before enrollment where the law requires it, explain how long the data is kept, and delete it when it is no longer needed. Laws such as the Illinois Biometric Information Privacy Act set specific requirements; confirm your obligations with counsel.
- Offer an alternative method where appropriate, such as an access card with supervisor review.
- Limit who can see check-in photos and biometric settings through role-based permissions.
Frequently asked questions
Is buddy punching illegal?
Recording hours that were not worked can amount to falsifying company records, and companies can generally discipline employees for it under their policies. How it is handled depends on your policies, contracts, and local law, so involve HR and counsel before taking action against an individual.
Will verification slow down the morning rush?
It should not, if the system is built for the gate. A face or card check-in at a kiosk takes a few seconds. A slow system is a design problem, not a reason to skip verification.
What about workers who forget to check out?
That is a different problem from buddy punching, but it causes similar errors. Flag missing check-outs for supervisor review rather than assuming a full shift.
How ADRO handles this
ADRO gives you several layers of protection against buddy punching, and lets you pick the level that fits each project:
- Face scan check-in at the gate kiosk, which can open the turnstile and keeps a photo with each entry. Workers register once and are then recognized at check-in, so one person cannot clock in for another.
- Access card check-in at the kiosk, or the gate QR code on the worker's own phone confirmed by a 4-digit code sent by text, for fast, low-friction capture on sites where that is enough.
- Raspberry Pi kiosks at the gate that make the site entrance the official check-in point and keep working offline.
- Supervisor spot checks: a face scan of any worker on site confirms who is actually there.
- Automatic close of entries still open after 8 hours, so a forgotten check-out does not turn into a 20-hour shift.
- Presence registry with automated attendance alerts to flag workers who are expected but have not checked in.
- Audit trail of every change to entry logs, plus custom roles with 80+ permissions that control who can edit hours.
- Manpower logs synced to Procore built from verified check-ins instead of sign-in sheets. See how to automate Procore daily log manpower entries.
Learn more about the platform on the ADRO jobsite time tracking overview.
Want to see it on your own jobsite? Book a 20-minute ADRO demo and we'll walk through it with your projects.