How buddy punching happens
Any attendance method that relies on something a person carries or knows can be delegated. RFID cards and ID badges are handed over at the gate. PIN codes are shared. Paper registers are signed for the whole team by whoever arrives first. In shared-phone setups, one supervisor marks ten workers from his own handset. Even fingerprint devices are bypassed when the enrolled template belongs to the wrong person – a friend enrols his own finger under the absent worker's ID.
It is rarely organised fraud. More often it is a favour: the shift starts at 08:00, a colleague's bus is late, someone swipes his card so he avoids a late mark. Repeated across a 300-person plant, the favours add up.
What it costs
The arithmetic is simple. If a worker on ₹18,200 a month (₹700 a day on the 26-day divisor) is covered for 2 absent days a month, the employer pays ₹1,400 for zero work. If 10% of a 300-person workforce does this, that is 30 people × ₹1,400 = ₹42,000 a month, or about ₹5 lakh a year, before counting overtime credited to people who left early. In contract-labour and security billing, the client pays for a guard who was never on post – which is a contract breach as well as a loss.
The indirect cost is worse: late marks and half-day rules stop working, the attendance percentage used for incentives is fiction, and a labour inspector comparing the register with the gate CCTV finds a mismatch you cannot explain.
Controls that actually stop it
The principle is to tie the punch to the person's body or to a device only they control, and to the place. Face verification with liveness detection covers the first: a colleague cannot lend his face, and a photo is rejected. A geofence covers the place. Device binding – one registered phone per employee – prevents one handset punching for a team. Supervisor-marked attendance should require the worker's face or a kiosk scan, not a checkbox.
Process helps too: publish the rule that punching for someone else is misconduct for both parties, compare punch counts with headcount at random, and review late-punch patterns (a cluster of punches at 07:59:30 from one card reader is a tell). The full playbook is in how to stop buddy punching.
- Face or fingerprint verification instead of cards and PINs
- Liveness detection so photos and videos fail
- Geofence per site plus one bound device per employee
- Random headcount vs punch reconciliation on the floor
- Written policy: proxy punching is misconduct for both employees
A packaging unit in Ahmedabad replaced RFID cards with a face terminal. In the first week, 14 workers who had shown 26 present days every month for a year suddenly showed 21–23. Nothing had changed in their shifts; the cards had simply been swiped by friends on their days off. The saving was roughly 60 paid days a month, about ₹42,000 at the unit's semi-skilled wage.
Attend Mitra prevents buddy punching with face recognition and a liveness check on every mobile or kiosk punch, geofencing per site, mock-location flagging on Android, and an audit trail that shows which device and location produced each record.