Time Theft and Buddy Punching: A UK Employer's Guide

A supervisor notices that one of her team is clocked in at 6.00am every morning but never seems to be on the floor until nearly seven. The card reader says otherwise. Somebody else has been swiping his fob.

Time theft — being paid for time not worked — is one of those problems every shift-based business has and few handle well. The temptation is to dock the pay and move on. In the UK that is very often unlawful, and it converts a straightforward misconduct case into an unlawful deduction from wages claim. This guide covers what time theft actually is, what you can and cannot do about it, and which prevention methods survive contact with the ICO.

What Counts as Time Theft?

"Time theft" is not a legal term in the UK. It is a workplace shorthand covering a spectrum, and treating everything on it identically is the first mistake:

The line that matters is dishonesty. Someone who takes 35 minutes for a 30-minute break has a conduct issue. Someone who clocks in a colleague who is at home in bed has made a false representation to obtain money. Only the second is realistically gross misconduct, and conflating them in a disciplinary hearing is how employers lose them.

It is also worth being honest about the last row. If your timesheet system rounds every clock-in down to the nearest quarter hour, that is your design decision, not employee dishonesty — and the rounding may itself be unlawful. Our guide to timesheet rounding rules covers where that goes wrong.

Can You Dock Their Pay?

This is the question employers ask first and research last.

Under section 13 of the Employment Rights Act 1996, an employer must not make a deduction from a worker's wages unless it is:

• Required or authorised by statute, or
• Authorised by a written term of the contract that the worker has seen before the deduction, or
• Agreed in advance by the worker in writing

"He didn't work the hours" is not, by itself, one of those. Where an employee genuinely did not work — an unauthorised absence for a whole shift — you are on solid ground not paying for time not worked at all. Where you want to claw back an hour here and there from a paid shift, you need the clause.

Deduct without authority and you turn a disciplinary case you would probably win into an unlawful deduction claim you will probably lose. Check the contract before payroll runs, not after.

Related but different is the position on unauthorised absence, where withholding pay for days not worked is generally permitted.

Investigating It Fairly

Time theft cases are usually lost on process rather than facts. The Acas Code of Practice on Disciplinary and Grievance Procedures applies in full, and a tribunal can uplift an award by up to 25% where it has been ignored.

1. Gather the evidence before the conversation. Clock records, rota, access-control logs, CCTV where it exists lawfully, and the timesheet audit trail.
2. Check the system before blaming the person. Duplicate records, a terminal with the wrong time zone, and shifts that cross midnight all produce data that looks like fraud and is not.
3. Hold an investigation meeting and put the discrepancy to the employee. People are entitled to explain, and sometimes the explanation is good.
4. Consider both parties in a buddy punching case. The person clocked in and the person doing the clocking are usually both in scope.
5. Invite to a disciplinary hearing in writing, setting out the allegation, supplying the evidence, and stating the possible outcome including dismissal.
6. Allow a companion — a colleague or trade union representative.
7. Decide on the balance of probabilities, not beyond reasonable doubt. You need a reasonable belief on reasonable grounds after a reasonable investigation.
8. Offer an appeal, heard by someone not previously involved.

Where the dispute is about the hours themselves rather than honesty, our guide to handling timesheet disputes covers the softer route.

Is It Fraud?

In serious cases, deliberately falsifying records to obtain pay can amount to fraud by false representation under section 2 of the Fraud Act 2006. In practice, prosecutions in an employment context are rare, and most employers deal with it as misconduct.

Referring a matter to the police is a significant step and rarely improves the employment outcome. Where the sums are large or the conduct is organised, take legal advice before doing so — and continue the disciplinary process in parallel rather than pausing it indefinitely.

“The app is simple to use, reliable, and makes managing holidays, absences, and staff records straightforward. The system has saved us a significant amount of administration time.”

Jordan Ingoe, CLI Manchester

TimeTally

No Fobs. No Biometrics. No Buddy Punching.

Employees clock in from their own phone, so nobody can swipe for anyone else. Optional GPS verification confirms they were on site — without collecting biometric data.

Start Free 14-Day Trial

Optional GPS verification

Complete audit trail

Real-time attendance view

Free for 14 days • No credit card required

Prevention: What Works, and What the ICO Will Stop

The Method Most Likely to Get You Fined

Fingerprint and facial recognition clocking is widely marketed as the definitive answer to buddy punching. It is also the method most likely to land you in front of the regulator.

Biometric data used to identify someone is special category data under UK GDPR. Processing it requires an Article 9 condition on top of your lawful basis, and a data protection impact assessment. Consent is a weak basis in an employment context precisely because of the imbalance of power — an employee who cannot clock in without giving a fingerprint has not freely consented.

In February 2024 the ICO issued an enforcement notice against Serco Leisure and associated trusts over the use of facial recognition and fingerprint scanning to monitor the attendance of more than 2,000 staff across dozens of leisure facilities. The ICO found the processing was neither necessary nor proportionate when less intrusive alternatives existed, and ordered them to stop and to destroy the data.

The lesson is not that biometrics are banned. It is that "it prevents buddy punching" is not on its own a sufficient justification when a phone-based clock-in would achieve the same result. If you are considering employee monitoring of any kind, read our guide to the ICO rules on monitoring workers first.

What Actually Works

• Remove the shared token. Fobs, cards and PINs can be handed over. A personal device cannot be, as easily.
• Location verification where it is proportionate. Confirming someone was at the site at clock-in is far less intrusive than continuous tracking, and it is enough.
• Exception reports, not surveillance. Flag the clock-ins that do not match the rota rather than watching everyone all the time.
• Manager approval as a real step. Most falsified hours pass through an approval that nobody read. Our guide to timesheet approval systems covers making that step meaningful.
• Write it into policy. You cannot dismiss for gross misconduct on the basis of a rule nobody was told about. Put buddy punching in the disciplinary policy by name.
• Fix the culture problem underneath. Widespread time theft is usually a symptom — of unrealistic rotas, of unpaid overtime going the other way, or of a manager nobody respects.

A Note on the Cost Figures

You will find articles claiming time theft costs UK employers a specific and alarming number of billions a year. Those figures are almost always vendor estimates with unclear methodology, extrapolated from small surveys or from US data.

Do your own sum instead. Take your hourly-paid headcount, multiply by average hourly rate, multiply by the number of minutes a day you believe is genuinely being lost, and multiply by working days. It will be a smaller number than the headlines and a much more persuasive one in a board paper, because you can show the working.

Key Takeaways

• Time theft is a disciplinary matter, not a criminal one, in all but extreme cases
• Separate dishonesty (buddy punching, falsified timesheets) from conduct issues (long breaks, lateness)
• You cannot deduct wages without statutory authority, a contract clause, or prior written consent
• Follow the Acas Code — most of these cases are lost on process
• Check the system for duplicates, time zones and midnight-crossing shifts before accusing anyone
• Biometric clocking is special category data and heavily restricted; the ICO acted against Serco Leisure in 2024
• Phone-based clock-in with optional location verification removes the opportunity without the regulatory risk

Frequently Asked Questions

Sources

• Employment practices: monitoring workers — Information Commissioner's Office
• Code of Practice on disciplinary and grievance procedures — Acas