Buddy punching is when one employee clocks in or out for another who isn’t there — a coworker covering for someone stuck in traffic, a punch from the parking lot, a friend clocked out early so they can leave. It almost never starts as theft. It starts as a favor. But it’s one of the quietest ways payroll money leaks out of a small business, and most time clocks don’t stop it — they just record where it happened, if that.
This is a straight look at two things: what buddy punching actually costs you, and how to actually block it rather than merely watch it happen. The short version of the fix is a control that refuses an off-site punch instead of logging it — an office-IP clock-in lock — and we’ll get to exactly how it works. First, the cost.
What it costs (do the math on your own shop)
There’s no honest single statistic that fits every business, so ignore anyone who quotes you one. The real cost depends on your team, your wages, and your habits. But the shape of it is easy to see.
Picture a padded few minutes per shift — an early clock-in here, a late clock-out there, a covered punch when someone’s running behind. It feels like nothing. Now run it across a whole hourly team, five or six shifts a week, every week of the year. Even a few minutes per shift, multiplied by every person and every day, turns into hours of paid time that no work backs up. That’s money leaving the till on a schedule.
The reason it’s so corrosive is that it’s invisible. It doesn’t show up as a fraud line on a report. It hides inside ordinary, well-meaning goodwill between coworkers, and it quietly inflates your labor cost pay period after pay period. To get a feel for your own exposure, take a typical padded interval, multiply by your average wage, then by your headcount and your shifts per week. Whatever number you land on, you’re paying it again next month unless something changes.
Why it’s so hard to catch
Buddy punching survives because most time clocks were built to track attendance, and prevention was bolted on later:
- Shared PINs or codes can be used by anyone for anyone.
- A punch on a personal phone can happen anywhere, because nothing ties the device to the workplace.
- GPS geofencing — the fallback most small-business clocks lean on — needs an app on every phone and can be spoofed from a couch. It tells you where a phone claims to be, not where the person is.
So the everyday tools give you a record of the cheating, not a wall against it.
What prevention costs elsewhere
Before the fix, it’s worth knowing what the market charges to solve this — because it explains why so many small shops just live with the leak. The well-known SaaS time clocks bill per head, and for a 25-person team that adds up. Approximate annual figures, as of June 2026 (vendors change pricing often, so confirm current rates): Buddy Punch runs around $1,520/yr, Deputy around $1,950/yr, and When I Work around $2,100/yr. Those are recurring, and they grow every time you hire.
That per-seat math is the reason a flat, self-hosted option is worth a look — you can see the alternative on the Punchwell pricing page, where it’s one price per site with unlimited employees rather than a bill that climbs with headcount.
How to actually block it
There are two location controls worth taking seriously, and it helps to be clear which is soft and which is hard.
GPS geofence (soft). A radius around your work site, checked against the punching device. Genuinely useful as a second layer, especially for staff who move between sites — but treat it as a deterrent, not proof. It can be spoofed and it needs an app.
Office-IP clock-in lock (hard). This is the control that closes the door. Your office network has a public IP address; an IP lock only accepts a punch from an address on your allowlist. A punch from home, the lot, or a spoofed phone is refused — server-side, not just logged.
That’s exactly how Punchwell’s office-IP clock-in lock works, and it’s the buddy-punch control most cheap clocks simply can’t do. A device on someone’s home Wi-Fi can’t fake your office’s public IP, so to punch in, they have to actually be on the network — which means being in the building. You can:
- Allow exact IPs, whole CIDR blocks (a range like
203.0.113.0/24), or address ranges — IPv4 and IPv6. - Combine allowlists company-wide, per office, and per employee — they union, so you only ever widen access.
- Apply it per employee, locking on-site staff to the building while remote workers clock in from anywhere.
- Choose block, warn, or flag enforcement, and have HR emailed when an off-site punch is refused.
Among SaaS tools, Buddy Punch and Zoho People do ship real IP restriction — both fine products — but they’re per-user cloud services holding your data. The closest WordPress competitor, WP ERP, offers an IP whitelist too, but it’s global-only (everyone or no one), not per employee. (Competitor details approximate, as of June 2026 — confirm current rates.)
Roll it out fairly
Don’t flip a hard block on cold. Tell your team first and explain why. Start in warn mode so off-network punches are recorded but still go through, use that window to find legitimate exceptions (an early-opening manager, a remote bookkeeper), grant those with the per-employee and per-office allowlists, then switch on block mode for the roles that need it. Because the lock is per employee, your remote people are never affected, and clock-out is never blocked, so nobody gets trapped on the clock.
Frequently asked questions
How much does buddy punching cost a small business?
There’s no honest universal figure — it depends on your wages, headcount, and shift patterns. The reliable way to estimate it is to take a typical padded interval per shift, multiply by your average hourly wage, then by your team size and shifts per week. Even a few minutes per shift compounds into real, recurring payroll cost.
What’s the most effective way to prevent buddy punching?
An office-IP clock-in lock is the hard control: it refuses a punch that doesn’t come from your office network’s public IP, rather than just recording the location. Unlike GPS, it can’t be spoofed from a phone at home, and unlike a shared PIN, it can’t be used remotely.
Isn’t blocking buddy punching expensive?
It doesn’t have to be. Per-user SaaS clocks can run roughly $1,520–2,100/yr for 25 staff (approximate, as of June 2026 — confirm current rates). A self-hosted, flat-priced option like Punchwell is one price per site with unlimited employees, so the cost doesn’t grow as you hire.
The bottom line
Buddy punching costs you quietly and continuously, and it persists because most clocks only watch. The fix is a control that refuses an off-site punch — a per-employee office-IP lock, rolled out warn-first. If you want to see how the numbers compare to a per-head SaaS bill, start with the pricing page.
Punchwell is an independent, third-party maintained fork of the GPL-licensed “WP Human Resource Management” plugin. Sturdyhaus is not affiliated with, endorsed by, or sponsored by wpspear, weDevs, the original author, or any other prior maintainer. Competitor names (Buddy Punch, Deputy, When I Work, Zoho People, WP ERP) are referenced descriptively only; all trademarks belong to their respective owners. Competitor pricing and capabilities are approximate, as of June 2026 — confirm current rates before relying on them.