Buddy clocking is one of the oldest attendance problems on guarding contracts. It needs no special skill, only a shared card, PIN or pen.
This guide explains what buddy clocking is and how to spot it in your records. It then covers the controls that stop it. If you are comparing systems, see our time and attendance system to stop buddy clocking.
What is buddy clocking?
Buddy clocking is when one employee clocks in or out on behalf of another. It is also called buddy punching. The colleague uses the absent person's card, tag, PIN or signature.
It usually takes one of three forms. An officer who is running late gets clocked in on time. An officer who leaves early gets clocked out at the end of the shift. Or an officer who never arrives is shown as present.
Why is buddy clocking a problem for security companies?
Buddy clocking means a post may be empty while your records say it is covered. On a guarding contract, that is a security risk before it is a payroll problem.
It also corrupts the records you rely on. Section 31 of the Basic Conditions of Employment Act (BCEA) requires employers to keep a record of the time worked by each employee. The record must be kept for three years, and no person may make a false entry in it.
Clients feel it too. If you bill or report by guard hours, a buddy-clocked shift means the client report is wrong. Disputes about hours are also harder to settle when nobody trusts the record.
How do you spot buddy clocking in attendance records?
You spot buddy clocking by looking for patterns that real attendance does not produce. One odd entry proves little. A pattern that repeats across shifts is worth checking.
| Warning sign | What it may mean | How to check |
|---|---|---|
| Several people clock in within the same minute, every day | One person may be scanning a handful of cards or tags | Compare with the gate log or CCTV for one shift |
| Clock-ins from outside the site or from the wrong site | Someone clocked in on the way, or for a colleague elsewhere | Check where each clock-in was recorded against the roster |
| Perfectly regular times that never vary | Times may be filled in after the fact on a paper register | Ask the supervisor to confirm a sample of shifts in person |
| A full shift with no patrol scans or OB entries | The officer may not have been on site for the whole shift | Match attendance against patrol and occurrence book records |
| Clock-outs at the exact end of shift, while relief arrived late | The outgoing officer may have left early and been clocked out | Compare the clock-out with the incoming officer's clock-in |
| The same officer is always clocked in by the same colleague | A habit of covering for each other | Rotate who clocks in where, and spot-check that pair |
Be fair when you investigate. Phones lose signal, readers fail and supervisors forget to update rosters. Ask for an explanation before you assume dishonesty.
Which clocking methods stop buddy clocking?
Methods that check who is clocking in stop buddy clocking. Methods that only check what was used, such as a card or a PIN, do not.
| Method | What a clock-in proves | Buddy clocking risk |
|---|---|---|
| Paper register or signature | That someone wrote a name and a time | High: anyone can sign, and times can be filled in later |
| PIN or swipe card on its own | That the PIN or card was used | High: PINs and cards are easy to share |
| NFC card or tag on its own | That the card was at the reader, at a recorded time | Medium: cards can be handed over or scanned in bulk |
| NFC with supervision and location rules | That the card was scanned at an approved point, with spot checks | Lower: sharing a card is more likely to be noticed |
| Facial recognition | That the enrolled person's face matched at clock-in | Low for sharing, but it uses biometric data that POPIA protects |
Facial recognition is the strongest check on identity, but it comes with legal duties. Biometric information is special personal information under section 26 of the Protection of Personal Information Act (POPIA). It may only be processed on a ground in section 27, such as consent.
Read facial recognition clocking and POPIA before you enrol staff. It covers consent, notice, security and how long to keep the data.
What controls stop buddy clocking?
Layered controls stop buddy clocking: identity at clock-in, a rule on where clock-ins count, supervision, and a written policy. No single control is enough on its own.
- Verify identity at clock-in. Use facial recognition, or pair NFC with a check that ties the scan to the person. A supervisor confirming faces at the start of a shift is a simple version.
- Set location rules. Decide where a clock-in counts: the site access point, a fixed point on site, or an approved zone for a mobile officer. Treat clock-ins from anywhere else as exceptions.
- Keep cards and devices under control. Issue one card per person, record who holds it, and cancel lost cards at once. Do not let officers keep a colleague's card.
- Supervise in person. Unannounced site visits at shift change show quickly whether the people on the roster are the people on site.
- Cross-check with other records. Match attendance against patrol scans, occurrence book entries and gate logs. A shift with no activity needs an explanation.
- Review exceptions every week. Go through late clock-ins, wrong-place clock-ins and missing clock-outs before payroll. Follow up the same day where you can.
- Act consistently. Apply your policy the same way on every site. Uneven enforcement teaches staff that the rule is optional.
For the wider supervision picture, see how to manage security guards effectively.
What should a buddy clocking policy say?
A buddy clocking policy should say, in plain words, that each person clocks only for themselves and what happens if they do not. Staff should sign it, and it should be explained in a language they understand.
- Each employee clocks in and out personally, at an approved point.
- Clocking for someone else, or asking someone to clock for you, is misconduct.
- Cards and tags are personal and must not be lent; losses are reported at once.
- What to do when a reader or phone fails, such as calling the control room.
- How the company checks records, and that attendance is compared with other records.
- How biometric data is handled, if you use facial recognition.
- That breaches are dealt with under the disciplinary code.
Discipline must follow your disciplinary code and a fair procedure. Get labour-law advice before you act on a specific case. This is a summary, not legal advice.
What should you do when you find buddy clocking?
When you find likely buddy clocking, secure the records first, then hear the people involved. Fix the gap in your controls as well as dealing with the individuals.
- Save the evidence. Export the attendance records, patrol scans, OB entries and any gate or camera records for the shifts concerned.
- Rule out technical causes. Check whether a reader, phone or network was down, and whether the roster was changed without being updated.
- Ask for an explanation. Speak to both employees separately, and record what each one says.
- Apply your policy. Follow your disciplinary code and a fair procedure, and treat similar cases the same way.
- Correct the records. Adjust pay and client reports to the hours actually worked, and note why the change was made.
- Close the gap. Ask how it was possible, then change the control, such as moving that site to facial recognition or adding spot checks.
Tell staff, in general terms, that records are checked and that cases are followed up. Visible follow-up does more to prevent buddy clocking than any single device.
How does Worxit handle buddy clocking?
Worxit Time & Attendance, supplied by Zamatrack, verifies clock-ins with facial recognition and NFC. Staff clock in at access points, on-site locations or approved mobile zones, and attendance is recorded by location.
- A live on-duty view shows who is working across all sites.
- Breaks, shift summaries and overtime are tracked, with reports of time worked.
- Staff are enrolled on a phone or uploaded in batches.
- Time & Attendance is a module of the same Worxit platform as Guard Patrol and Occurrence Logs.
The Worxit dashboard licence is R600 per month, including one admin user. Extra dashboard users are R75 per user per month. Each phone, tablet or radio running the app needs a R350 per month mobile device licence. All prices exclude VAT.
Frequently asked questions
What is buddy clocking?
Buddy clocking is when one employee clocks in or out for another, using their card, tag, PIN or signature. The attendance record then shows a person on duty who was not there, or a longer shift than was worked. It is also called buddy punching.
Is buddy clocking a dismissible offence?
It can be treated as dishonesty, but the outcome depends on your disciplinary code, the evidence and a fair procedure. Put the rule in writing, make sure staff have signed it, and get labour-law advice before acting on a specific case. This is a summary, not legal advice.
Does NFC clocking stop buddy clocking?
Not on its own. An NFC card or tag proves the card was present, not the person. NFC works well against buddy clocking when it is paired with something that ties the scan to the person, such as a supervisor check, a site rule on where scans count, or facial recognition.
How often should we check attendance records for buddy clocking?
Review exceptions at least weekly, and before every payroll run. Look for clock-ins from the wrong place, identical times for several people, and shifts with no patrol or OB activity. Investigate patterns rather than single odd entries, because devices and networks also cause gaps.
Do we need staff consent to use facial recognition clocking?
Facial recognition uses biometric information, which POPIA treats as special personal information. You may only process it on a ground in section 27, and consent is one of them. Read the POPIA rules before enrolling staff. This is a summary, not legal advice.
Sources
Read on 22 October 2026. General information, not legal advice.
- Basic Conditions of Employment Act 75 of 1997. Government Gazette 18491, published on gov.za. Section 31 (keeping of records).
- Protection of Personal Information Act 4 of 2013. Government Gazette 37067, published on gov.za. Sections 1, 26 and 27.