A practical framework for combining selfie evidence, local biometric approval, approved devices, and manager review without slowing employees down.
Buddy punching is the oldest payroll leakage problem in field operations. One employee taps in for a colleague who is late, absent, or off-site, and the timesheet records both as present. The cost is rarely a single shift. It compounds across weeks, normalises into a culture, and slowly erodes the integrity of every report you pull.
The instinct is to layer in stricter rules: face scans, fingerprint readers, surprise audits. But field teams are not warehouse floors. Workers are mobile, networks are patchy, and the people you are trying to protect are also the people you are asking to comply. Make controls too painful and you trade fraud for refusal — employees stop checking in at all, and the data you wanted gets worse, not better.
The framework below is what we recommend to operations leaders who want to close the buddy-punching gap without breaking the field experience.
Most fraud-resistant attendance systems combine four layers. None of them is sufficient alone. Together they make impersonation expensive enough that it stops being a habit.
Passwords and PINs are shareable. Selfies and on-device biometrics are not — at least not at the scale and speed buddy punching depends on.
A selfie captured at the moment of check-in serves three purposes:
Pair the selfie with the device's local biometric (Face ID, fingerprint) as the approval gesture. This keeps the biometric template on the device — you never store a face vector on your servers — while still requiring the employee's actual presence to complete the action.
A selfie taken in the wrong location is still evidence of fraud. Geofencing turns location into a precondition: the check-in button does not appear, or appears in a warning state, when the device is outside the approved boundary.
The important detail here is precision. A geofence drawn too wide accepts check-ins from the car park down the road. A geofence drawn too tight produces false rejections on rainy days when GPS drifts. The right default is a 50–80 metre radius for most worksites, with named adjustments for large facilities (hospitals, construction sites, distribution centres).
A given employee should be checking in from a known device — usually their personal phone, registered on first use. When a check-in arrives from a different device, that is a signal worth surfacing.
You do not have to block it. A first-time device on a Monday morning is often just a replaced phone. But the system should:
This single control kills the most common buddy-punching pattern: one employee, two phones, two check-ins.
The fourth layer is organisational. If selfies, geofences, and device signals all live inside a system nobody reviews, they do nothing. The point is not to collect evidence. The point is to act on it.
A weekly attendance exception report — five minutes for a supervisor to scan — should surface:
Make the review part of the operating rhythm. Make sign-off auditable. Buddy punching collapses quickly when employees understand that someone actually looks.
Several controls sound good in slide decks but cause more friction than fraud they prevent.
Continuous tracking. Recording location every five minutes throughout a shift is rarely necessary, often illegal under local labour law, and almost always corrosive to trust. Capture location at check-in and check-out. That is enough for compliance.
Server-side face matching at scale. Sending every selfie to a face-recognition API is expensive, slow, and creates a new privacy surface. Use the selfie as evidence, not as the primary authentication. Reserve face matching for exception review, not the default path.
Hard biometric enforcement. Requiring fingerprint on every check-in produces failure rates that frustrate workers with worn or wet hands. Use local biometrics as the approval gesture for the check-in, not as the check-in itself.
Punitive defaults. A system that blocks attendance on any anomaly punishes employees for poor signal as much as for fraud. Default to capture and flag, not to block. Let humans resolve ambiguity.
In our experience helping teams roll this out, the order matters as much as the controls.
The teams that succeed treat this as an operations project, not an IT project. The technology is the easy part. The operating rhythm — who reviews, when, with what authority — is what makes the controls real.
A mature field attendance programme should be able to answer three questions on any given day:
If you can answer those three questions without exporting to a spreadsheet, you have moved past attendance tracking. You have an attendance integrity programme. That is the goal.
Keep reading
Fingerprint readers and ID cards at the office entrance solved a 2005 problem. Hybrid schedules, client sites, and remote days have outgrown them. Here is what to use instead — and how to migrate without breaking trust.
GeofencingThe real value of geofencing is not the circle on the map. It is the record that connects person, place, time, policy, device, and exception state.
Onsight can help you define geofences, trust controls, exception flows, and reporting rules around your real workforce.
Walk through your rollout
Bring your site structure, employee groups, and compliance concerns.
Book demo