Buddy-punching — one employee clocking in for another — is the quiet payroll leak most owners underestimate. It rarely looks like theft: a coworker punches you in because you’re stuck in traffic, or covers the last ten minutes so you can leave early. But a few padded minutes per person per shift, multiplied across a team and a year, adds up to real money paid for hours nobody worked. ClockAll shuts the door on it with face verification — while protecting employee privacy by storing only encrypted embeddings, never raw face images.
What buddy-punching actually costs you
Industry estimates put time theft at a meaningful slice of gross payroll for hourly teams, and buddy-punching is one of its biggest sources precisely because it’s so easy with a shared PIN or a paper card. The cost is invisible on any single timesheet, which is what makes it persistent. Before you fix it, it’s worth putting a number on it — our time theft calculator estimates your annual exposure from padded minutes in about thirty seconds.
How face verification works
When an employee enrolls, ClockAll detects their face on the device and converts it into a mathematical embedding. At each clock-in from the app, the phone captures a fresh embedding and the server compares it to the enrolled template before the punch is accepted — the scoring is deliberately server-side, so a client can’t claim a match it didn’t earn. If the match fails or the camera isn’t available, the employee falls back to a personal PIN, so nobody is ever locked out of clocking in. Punches made with no signal queue on the device and are verified when they sync.
What the check does — and what backs it up
Face matching closes the easy path: a coworker can’t punch you in from their own phone, because the face at the camera has to match your enrolled template. It is one layer of several, not a lie detector — so ClockAll pairs it with geofencing (the punch has to happen at the location), an immutable audit log, and a manager review flag on the timecard showing the match score behind each verified punch. If a punch looks wrong, the evidence to question it is already recorded.
Face ID vs. PINs and fingerprints
PINs are better than a shared code, but they’re still shareable — you can text a four-digit PIN to a coworker. Fingerprint readers are strong but need dedicated hardware that breaks, gets dirty, and costs money to replace. Face verification runs on the tablet or phone you already have, needs no special hardware, and can’t be shared the way a PIN can. For most teams it’s the best balance of security, cost, and speed at the door.
Privacy: embeddings, not photos
ClockAll never stores a photo of anyone’s face. It keeps only a mathematical embedding — a set of numbers that can verify a match but cannot be reversed back into an image. Enrollment is opt-in, with clear written notice and the employee’s written consent, and there’s always a PIN alternative for anyone who declines. Embeddings are encrypted, access-controlled, and destroyed under a written retention policy when someone leaves. That’s what keeps the feature aligned with biometric-privacy laws like Illinois’ BIPA and California’s CCPA — details are on our security page.
Rolling it out to your team
Deployment is an afternoon, not a project. Enroll faces during a shift, set up a tablet by the door as a PIN kiosk for anyone who doesn’t punch from their own phone, and communicate clearly why you’re doing it — honest hours protect the people who show up on time as much as they protect the business. Because every punch is verified, your timesheets stop leaking, managers spend less time chasing exceptions, and the hours you export to payroll reflect the work that actually happened.
Frequently asked questions
Is face recognition clock-in legal?
Yes, when done with proper notice and consent. Biometric-privacy laws like BIPA and CCPA require written notice, consent, and a retention/destruction policy — all of which ClockAll’s enrollment flow is built around. Always confirm your specific obligations with your own counsel.
What if an employee doesn’t want to use face ID?
Enrollment is opt-in. Anyone can decline and clock in with a personal PIN or at a shared kiosk instead — no one is forced to enroll a faceprint.
Does it work without internet?
Yes — employees can clock in offline. The punch is saved on the device with its real time, and it syncs (and is face-verified) automatically when the connection returns.
See it on your own team
Set up face-verified clock-in in an afternoon — free for teams up to 3.