Time theft, read from the evidence end
The terminal recorded a credential. Not a person.
Fifty notes on buddy punching and time theft, written backwards from the evidence. Not a catalogue of controls to buy — a working account of what each record actually attests, which claims it supports and which it merely fails to contradict, what a second source is worth, and what has to be true before the word theft is used about anybody.
One morning, four systems, one employee
Records a credential presented at a reader.
Records the same credential, 52 seconds later.
A different credential, on a machine three people use.
Given five weeks after the day in question.
Overwritten after fourteen days.
The two systems that agree are reading the same badge, so they are one source and not two. Clock drift between the door system and the time terminal had never been measured. This is one employer's own file, not a statement of what any rule requires about evidence.
No jurisdiction is told what its law requires. Every figure here is an illustration of what an employer recorded for itself, labelled as such. Nothing in this collection is legal advice: what monitoring is permitted, what evidence is admissible, what a fair process requires and what may be deducted from pay differ by jurisdiction, by sector and by agreement, they change, and they are a question for somebody qualified in the place concerned.
The two tables that decide the case
What one employer wanted to say, against what its own records held
One of the six claims is supported by a record. Two are consistent with several explanations, two are not shown at all, and one cannot be tested because the logs are gone. Every row is what one employer found in its own systems, not a statement of what any rule requires about evidence.
Six controls against buddy punching, costed by one employer
The cheapest control on the list stops nothing directly and removes the reason the behaviour exists. What each control costs, what it records about people and whether it is permissible where you operate are separate questions, and the last of them is for somebody qualified in the place concerned.
The evidential discipline in “The terminal recorded a credential. Not a person.” should also govern workforce technology. A team evaluating see how the platform works in practice for how employee monitoring works can use time and project records as operational context, but should preserve the original record, document access and let the employee correct a misleading entry before it supports a conclusion.
A broader reference for the question in “The terminal recorded a credential. Not a person.” is the ENISA cybersecurity education. Read it alongside the local facts so that an external framework informs the assessment without replacing case-specific judgement.
Why this starts at the evidence
Most writing about time theft starts with the loss and works forward: here is what it costs, here is what to buy. This collection starts at the other end, with the record itself, because that is where almost every case either holds together or quietly falls apart.
A badge reader records that a credential was presented. A terminal records that a button was pressed. An activity monitor records input, not work. A phone records where a phone was. Each of those is a narrow, reliable fact, and each of them sits some distance from the statement an employer actually wants to make — that a particular person was, or was not, working. Crossing that distance is an inference. It is often a reasonable one. It is almost never written down, and the cases that go wrong are the ones where nobody noticed they were making it.
So the sections run in that order: what each record attests, the identity problem that buddy punching really is, what the other measurement systems measure, what has to be true before the word theft is used, what a second source is worth, what a proportionate response looks like, and finally the conditions that produce the behaviour in the first place — which are usually a queue, a rounding rule or a rota, and which are cheaper to fix than anything else on this site.
01 / 07
What a punch records
What each method actually attests, and the distance between that and a fact about a person.
02 / 07
The identity problem
Buddy punching: why it happens, what each control stops, and what each one costs.
03 / 07
What else gets measured
Idle time, activity, location and productivity scores — what each measures and what it is read as.
- Idle Time Measures Input, Not Work
- Activity Monitoring and What It Sees
- Location, and the Distance to a Conclusion
- Productivity Scores as Evidence
- Notice, and What People Should Be Told
- Output Figures, and Where They Mislead
- The Measure That Changes the Work
- Aggregate Reporting Without Individual Surveillance
04 / 07
Before you call it theft
What the word does, what has to be established first, and the explanations that fit the same facts.
05 / 07
Corroboration
The second source, clock drift between systems, and what a reconstruction can and cannot establish.
06 / 07
What follows
The response, its consistency, recovering pay, and the reaction that costs more than the loss.
Independent product comparisons
Tool guides
Three differently structured comparisons based on practical evaluation, published product information and repeatable operating criteria.
07 / 07
Designing it out
The conditions that make the behaviour rational, and the changes that remove the reason for it.
The short version
Ask what the record attests, before asking what it shows
Every system in this collection records one narrow fact: a credential was presented, a key was pressed, a device was in a place. The step from that to a statement about a person is an inference, and it is the step nobody writes down. Write it down. Most of what gets called time theft dissolves at that line, and what survives it is both smaller and far easier to act on.