When Your Employee Time Clock Can't Prove Who Punched In

Most payroll admins treat buddy punching as a discipline problem. One employee clocks in for another, HR investigates, somebody gets a warning or a walk to the door, and the file closes. That's wrong in one big way: buddy punching is a system failure, not a trust failure. Fire someone over it without a verified digital clock-in trail, and it won't survive a tribunal.

Workzoom's exception-based time clock closes that gap. It verifies who's standing at the clock, not just the code they typed or the card they swiped. Then it compares the punch against the schedule before anything reaches payroll. Pair that with an audit trail nobody can quietly edit, and you get a record that holds up when a termination gets challenged. A shared PIN rarely does.

You're not failing at enforcement. Your punch clock was never built to produce the proof a tribunal wants.

What Unverified Punches Actually Cost Your Payroll

Here's the number most payroll teams never run: what a single unverified punch costs before anyone even notices it's wrong.

Industry estimates long attributed to the American Payroll Association (now PayrollOrg) put buddy punching and related time theft at 1.5% to 5% of gross payroll. Run that against a 200-person shift-based operation's payroll and the number gets real fast, quietly baked into the labour line before finance ever asks a question.

That's before the fix. PrimePay puts the average time to correct a single bad punch at 26 minutes per employee. Multiply that across every pay period, every site, every supervisor too busy to eyeball a hundred punch cards a shift. It adds up fast.

ADP's own 2024 research found 63% of employees report having been underpaid at some point, and 20% say they notice payroll errors often. Not once. Often. That's not noise. That's a structural problem. A memo won't fix it.

There's a second problem hiding behind the first: manual re-keying introduces plain transposition errors that look identical to time theft on the page.

Picture the employer running crews across three job sites. A worker texts a photo of a handwritten slip to the office, someone retypes the hours into a spreadsheet, and nobody downstream can confirm who actually wrote those numbers down in the first place.

Why PIN Codes and Swipe Cards Cannot Catch It

A PIN verifies that somebody knows four digits. A swipe card verifies that somebody is holding a piece of plastic. Neither one verifies the person standing at the clock.

That's not a training gap you can memo your way out of. If the verification method itself doesn't tie a punch to a person, buddy punching isn't misconduct. It's the system working exactly as designed. A shared PIN is not a security control. It's a liability sitting in your payroll register, waiting for a hearing date.

Now picture the payroll team on the other end: four site supervisors submit paper timesheets with hand-checked start and end times, someone calculates overtime by hand, then re-keys the totals into payroll. There's no verification step anywhere between the paper and the paycheque.

Biometric and facial-recognition clocks close the identity gap, but they come with rules of their own. The Office of the Privacy Commissioner's 2025 guidance sets conditions under which biometric time clocks can be used lawfully: a clearly articulated need, proof no less-intrusive option would work, proportionality, informed consent, minimal collection, and real safeguards. That's a reason to set them up properly, not a reason to skip them.

If your clock-in method can't confirm who actually punched in, everything downstream, overtime, statutory pay, termination records, inherits that uncertainty. And uncertainty is exactly what a tribunal picks apart.

Can You Terminate an Employee for Buddy Punching in Canada?

Short answer: yes. But the punch log by itself won't carry the case.

Under Part III of the Canada Labour Code (sections 240 to 242), adjudicators and courts have consistently held that the employer carries the burden of proving just cause, not the employee. A shared PIN with no corroborating identity check is a thin justification to bring into that hearing.

The 2019 federal case Hussey v. Bell Canada, 2019 CanLII 883 (CA LA) made that concrete: an adjudicator ruled the employer couldn't terminate an employee over clocking-policy violations without progressive discipline first. Punch records without documented prior warnings and a real chance to improve weren't enough.

There's a clock running on the employee's side too. Unjust dismissal complaints must be filed within 90 days, and if the employee requests it, you have 15 days to provide written reasons for the termination. That's not much runway to reconstruct what happened from a paper log and somebody's memory of a Tuesday three months back.

None of this means buddy punching should be tolerated. It means the fix isn't a harder conversation with the employee. It's a clock-in method that produces the proof before you need it, not after.

What a Verified Employee Time Clock Actually Needs

A verified time clock has to do three things a PIN pad can't: confirm identity, compare the punch to the schedule, and log the result somewhere nobody can rewrite after the fact.

Physical punch clocks fail on the first point constantly. At Silvera for Seniors, a senior care operator running 36 buildings in Calgary, HR generalist Crystal Murray put a number on how often theirs broke down before they moved off it.

"10-15% of our staff would have issues [with punch clocks] and would have to enter manually."

Crystal Murray, HR Generalist, Silvera for Seniors

That's not a small crack. That's roughly one in eight punches needing a human to fill in the blank by hand, after the fact, from memory.

Biometric and facial-recognition clocks close that identity gap directly. Island Luck, a Bahamian gaming operator running more than 60 locations, deployed facial recognition across its sites for exactly this reason. A badge can be shared. A face can't.

Verification alone isn't the finish line. The comparison step is what turns a punch into evidence: was this person scheduled here, at this time, doing this job? A punch with nothing to compare against is just a timestamp.

Building the Audit Trail Finance and HR Can Both Point To

None of this holds up if the record disappears the moment somebody edits it.

Workzoom's timekeeping tags manager-entered punches separately from an employee's own punch, and it doesn't delete the original exception when a manager fills in a missing one. Both versions stay on the record. That distinction, who entered what and when, is exactly what an adjudicator wants to see months after the fact.

It also has to last. Under the Canada Labour Code, employers must keep payroll and employment records for at least 36 months, then another 36 months after employment ends. Six years, in practice, per employee. A spreadsheet on someone's desktop rarely survives that cleanly once the person who built it moves on.

A 2024 CBC News investigation, using Ontario Ministry of Labour data obtained through a freedom-of-information request, found roughly $60 million in Ministry-ordered unpaid wages between 2017 and 2024 that employers never paid. Bad records don't just lose termination challenges. They lose money nobody sees coming until it's gone.

If a termination challenge ever lands in front of an adjudicator, the severance math shifts fast depending on tenure and cause. There's a worksheet at the end of this post that runs that math for you, so you're not doing it live in a hearing room.

See 7 signs your payroll system is failing for the rest of what a disconnected time clock quietly breaks.