Stop Buddy Punching With Face ID and Geofencing Safely

Face ID stops buddy punching because a coworker cannot lend their face the way they lend a badge or PIN, and geofencing stops punches from the parking lot or from home. Both collect sensitive data, so the program only works if you pair the technology with written consent, a published retention schedule and a non-biometric fallback.

Disclosure: The author works at CloudApper, which makes CloudApper AI TimeClock, which is discussed in this article.

Key takeaways

  • Badges, PINs and shared codes can all be handed to a coworker. A face match at the point of punch removes that option.
  • Geofencing answers a different question: whether the punch happened at the work location, not who made it.
  • In Illinois, the Biometric Information Privacy Act requires a public retention policy, written notice and a written release before you collect face data.
  • Design the policy, consent flow and fallback method before you enroll the first employee, not after.

What is buddy punching and why do badges and PINs fail?

Buddy punching is when one employee records time for another, usually clocking in a late coworker or clocking out someone who left early. It is hard to detect because the punch looks normal in the timecard. Supervisors notice only when they see someone arrive after their recorded start time, and few want to confront a team about it.

Every credential that can be carried can be shared. Badges are lent, PINs are written on the back of a phone, and QR codes can be screenshotted. Our earlier piece on addressing employee time theft covers the culture side: most buddy punching is a favor between friends rather than organized fraud, which is why controls should be routine and impersonal rather than accusatory.

How do face ID and geofencing stop time theft?

The two controls answer different questions, and many organizations need both.

ControlQuestion it answersStopsDoes not stop
Face ID at a shared tabletIs this the right person?Buddy punching with lent badges or PINsPunching from the wrong site if devices are portable
Geofencing on a phone or tabletIs the punch at an approved location?Clocking in from the car, home or another siteOne employee punching for another on the same phone
Face ID plus geofencingRight person, right place?Both patterns aboveOff the clock work, which is a scheduling and culture issue
Badge or PIN onlyWas a valid credential presented?Simple mistakesShared credentials

For example, CloudApper AI TimeClock lists a Face ID Agent for touchless check-in that "prevents buddy punching" and a Location Verification Agent that combines geofencing with face biometrics. It also supports QR code, barcode and NFC punches, which matters for the fallback method discussed below. UKG customers can compare how these controls fit their platform in our guide on stopping employee time theft in UKG Ready, Dimensions and Pro.

What does Illinois BIPA require before you use face ID?

The Illinois Biometric Information Privacy Act (740 ILCS 14) is the most demanding biometric statute employers deal with, and it applies to scans of face geometry. The statute text published by the Illinois General Assembly sets out these duties for private entities in Section 15:

  • Public written policy (15(a)): a publicly available retention schedule and destruction guidelines. Biometric data must be destroyed when the initial purpose for collecting it has been satisfied or within 3 years of the individual's last interaction with the entity, whichever occurs first.
  • Notice and release before collection (15(b)): inform the person in writing that the data is being collected or stored, state the specific purpose and length of term in writing, and receive a written release.
  • No profiting (15(c)): the entity may not sell, lease, trade or otherwise profit from the data.
  • Limited disclosure (15(d)): disclosure only with consent or under the narrow exceptions the statute lists, such as a legal requirement or a valid warrant or subpoena.
  • Reasonable security (15(e)): protect the data using the reasonable standard of care in your industry, and at least as carefully as your other confidential information.

Section 20 gives aggrieved persons a right of action with liquidated damages of $1,000 for negligent violations and $5,000 for intentional or reckless ones, or actual damages if greater. Public Act 103-769, effective August 2, 2024, amended the Act so that repeatedly collecting the same person's biometric data by the same method counts as a single violation, and it added electronic signatures to the definition of a written release. That narrows exposure but does not remove it: a missing consent is still a violation. Our analysis of the BIPA ruling every HR leader should read covers the litigation background.

Illinois is not the only jurisdiction with biometric rules, and city ordinances and other state laws can apply too. Have counsel review your policy for every state where you operate. This article is practical guidance, not legal advice.

How do you build a compliant face ID time clock program?

Step 1: Write the policy first

Publish a biometric retention and destruction policy that names the purpose (timekeeping and identity verification), the retention period, the destruction trigger at separation, and who can access the data. Post it where employees and applicants can find it, such as your careers site or employee handbook portal.

Step 2: Build consent into enrollment

  • Show the written notice and purpose on the device or on paper before the camera turns on.
  • Capture a signed release, electronically or on paper, and store it with the employee record.
  • Record the date of consent so you can prove it preceded the first scan.

Step 3: Offer a fallback

Give employees who decline biometrics a non-biometric option such as a badge, QR code or PIN, combined with geofencing or supervisor verification. A fallback keeps the program voluntary in practice and avoids a stalled rollout when a few people object.

Step 4: Wire destruction into offboarding

Add a step to the termination checklist that deletes the face template and logs the deletion. Ask your vendor to show you how that deletion works and whether it reaches backups.

Step 5: Scope geofences narrowly

Collect location only at the moment of the punch, draw the fence around the work site rather than a whole town, and say so in the policy. Employees accept location checks far more readily when they know the app is not tracking them all day.

What should you ask vendors about biometric data?

  • Do you store a face image, a mathematical template or both, and where?
  • Is biometric data ever shared with or processed by third parties, and under what contract terms?
  • Can we configure consent screens and capture the signed release in your app?
  • How do we delete one employee's template, and how is deletion logged?
  • Can each site use a different punch method, including a non-biometric fallback?
  • How does geofencing behave when GPS is weak indoors, and what does the supervisor see when a punch falls outside the fence?

Frequently Asked Questions

Is facial recognition legal for employee time clocks?

Generally yes, but some states regulate how biometric data is collected, stored and destroyed. In Illinois, BIPA requires a public retention policy, written notice of the purpose and term, and a written release before collection. Review the rules in every state where you operate and get legal review of your consent forms before enrollment begins.

Does geofencing count as tracking employees?

It depends on how it is configured. A geofence that checks location only at the moment of a punch is far less intrusive than continuous tracking. Limit collection to punch events, draw fences tightly around work sites, explain the purpose in writing, and check whether state or local privacy laws impose additional notice requirements.

What should we do if an employee refuses to enroll their face?

Offer a documented alternative such as a badge, QR code or PIN paired with geofencing or supervisor confirmation. A fallback keeps the program workable, reduces friction, and fits privacy laws that require informed consent. Track the fallback group's exceptions separately so you can see whether the alternative method is being misused.

How long can we keep employee face templates?

Under Illinois BIPA, biometric data must be destroyed when the initial purpose is satisfied or within 3 years of the person's last interaction with the employer, whichever comes first. For timekeeping, the purpose usually ends at separation, so build deletion into offboarding rather than waiting for the outer limit.

Next steps to stop buddy punching

  1. Pull a month of punch data and flag patterns that suggest shared credentials, such as consecutive punches seconds apart for people who arrive separately.
  2. Draft your biometric retention policy and consent language, and send them to counsel before you choose a vendor.
  3. Decide per site whether you need face ID, geofencing or both, using the comparison table above.
  4. Run a pilot that includes enrollment, a declined consent and an offboarding deletion, so you test the whole lifecycle.

For related wage and hour rules, browse our payroll compliance guides. To see how face ID, geofencing and fallback punch methods are configured in practice, review the CloudApper AI TimeClock product page.

Last reviewed: October 2026.

Sources

Comments

Post a Comment

Popular Posts

Why Workday Onboarding Breaks Down for Frontline Employees

Image
The Onboarding Gap Nobody Talks About Workday's onboarding module is well-designed for its intended audience: office-based, desk workers with reliable computer access, personal email addresses, and the digital literacy to navigate a web-based portal. For this population, Workday onboarding works well, it automates tasks, routes approvals, collects documents, and creates a reasonably smooth first-week experience. But most organizations using Workday have a substantial population of frontline workers: warehouse employees, retail staff, manufacturing workers, healthcare aides, food service workers, drivers. For this population, the standard Workday onboarding experience frequently fails in ways that are predictable, documented, and, crucially, fixable. Understanding why it breaks down and what actually works is increasingly urgent as labor market competition for frontline talent intensifies. How Standard Workday Onboarding Is Designed Workday's new hire onboarding (delivered throu...
Read more

How to Improve the Customer Experience (CX)

Customer experience is the sum of every interaction a customer has with your company, from the first ad they see to the way a return gets handled years after the purchase. Companies that take this seriously outperform those that treat CX as a support function. The ones that struggle tend to confuse customer satisfaction scores with actual improvements, or fix the wrong things. Here's a practical look at what actually moves CX forward. Start with where customers actually struggle Most CX improvement programs begin with surveys. Surveys are useful but limited, they capture what customers are willing to articulate after the fact, which tends to under-report friction in the middle of an experience and over-index on the most recent interaction. The richer data comes from observing behavior directly: where do customers drop off in a purchase flow? Where do support tickets spike? What search queries are people entering on your site that suggest they can't find what they're loo...
Read more

Infor HCM Software Engineer Jobs: Salary Factors and Skills

An Infor HCM software engineer's salary depends mostly on the type of employer, the depth of Infor platform knowledge, and location. Engineers who combine general software skills with hands-on experience in Infor CloudSuite HCM, Lawson, Infor ION integrations and payroll logic tend to command more than generalist developers, because that combination is scarce in the job market. What does an Infor HCM software engineer actually do? The title covers several different jobs, and pay follows the job more than the title. Broadly, these engineers build, configure, integrate and support the Infor human capital management stack, which includes core HR, payroll, benefits, talent management and workforce management. Many organizations still run the older on-premises Infor Lawson system alongside or instead of the cloud suite, so experience with both is common. Typical responsibilities include: Building and maintaining integrations between Infor HCM and payroll providers, benefits carrie...
Read more

UKG Union Contract and Overtime Rules for Multi-Site Food Plants

Multi-site food manufacturers running UKG often struggle with one thing: each plant has its own union contract, shift pattern and overtime rules, while the timekeeping system is configured centrally. The fix: document every contract rule precisely, map it to UKG pay rules and work rules, test against real timecards, and handle true exceptions with add-ons rather than core customization. Disclosure: The author works at CloudApper, which makes the UKG add-ons discussed in this article. Why are union contracts so hard to configure in UKG? Federal law sets a floor. Under the Fair Labor Standards Act, non-exempt employees must receive at least one and a half times their regular rate for hours worked over 40 in a workweek. Collective bargaining agreements frequently go further, and food plants often have several agreements across locations. Common contract provisions include: Daily overtime after 8 hours, or after 10 on a four-day schedule. Double time on the seventh consecutive day o...
Read more

How Do I Log In and Sign In to Workday HCM

Workday HCM is the system your organization uses to manage everything from your pay stubs and benefits to time off requests and performance reviews. Getting in is usually simple once you know where to go, but first-time login, password resets, and single sign-on setups can trip people up if no one has walked them through it. Here's what you need to know. How to find your Workday login URL Workday doesn't have one universal login page. Each organization has its own tenant, a dedicated instance with a unique URL. Your company's HR department or IT team should have provided the URL when you were onboarded. It usually looks something like your-company.workday.com or wd3.myworkday.com/yourcompany . If you weren't given the URL, check your onboarding email, your company's intranet, or ask HR directly. Some organizations also link to Workday from their internal HR portal. Don't try to guess the URL, there's no central directory, and guessing wrong just takes...
Read more

How to Search in Workday: Find Reqs, Reports, People and Tasks

To search in Workday, type into the global search bar at the top of any page, press Enter, then use the category filters on the left of the results to narrow to people, organizations, tasks and reports or other object types. Workday only returns items your security roles allow you to see, so missing results often mean an access issue rather than a typo. How does Workday search work? Workday uses a single global search box rather than separate menus for each module. Everything in the tenant, from a worker's profile to a job requisition to a custom report, is an object that search can find if you have permission to view it. Three points explain most search behavior: Security trimming. Results are filtered by your security groups. A recruiter and a payroll partner typing the same term will see different results. Categories. After you press Enter, results are grouped into categories that appear as filters. Clicking one hides everything else. Related actions. Once you open an...
Read more

New Apple Watch Health Features Will Be Available This Year, but Blood Pressure and Blood Sugar Sensors Will Not Be Available Until Next Year

Image
What Apple confirmed for its upcoming watch lineup Apple's annual health feature announcements for its Watch lineup continue to generate significant attention, both from health enthusiasts who track every new sensor addition and from the clinical research community that increasingly uses consumer wearables in studies. The pattern that has emerged over the past several product cycles is consistent: Apple confirms a set of features that will ship with the current year's model and acknowledges separately that other, more complex sensors are still in development and will not arrive on schedule. This year's announcement followed that pattern closely. Several new health monitoring capabilities are confirmed for the current Apple Watch generation, representing meaningful additions to what the device can track passively. At the same time, the two most anticipated sensor additions, continuous blood pressure monitoring and non-invasive blood glucose measurement, will not be availa...
Read more

The Future of Employee Healthcare Key Concerns and Strategies for 2024

In a rapidly evolving professional landscape, employers are grappling with an array of challenges as they plan employee-sponsored healthcare strategies for 2024. A recent survey conducted in the US in August 2023 sheds light on the primary concerns and emerging trends in the realm of employee healthcare. Mental health, healthcare costs, pharmacy expenditures, and transformative technologies are at the forefront of employer considerations, signaling a need for comprehensive and innovative approaches to employee well-being. Rising Mental Health Concerns A staggering seven in 10 employers reported a surge in mental health concerns, marking a significant uptick from the previous year. With 77% of employers experiencing an increase and an additional 16% anticipating future challenges, the mental health landscape is a top priority. The implications of the ongoing pandemic, remote work dynamics, and societal shifts are evident as employers grapple with addressing and supporting the mental ...
Read more

How Digital Marketing Helps Your Business Grow: A Practical Plan

Digital marketing helps a business grow by putting it in front of buyers at the moment they search, compare and decide, then measuring which efforts produce revenue. Search, content, email, paid ads and social channels let even small teams reach targeted audiences, test messages cheaply and shift budget toward what works, something print and broadcast advertising rarely allow. How does digital marketing actually drive business growth? Growth comes from three levers: reaching more of the right people, converting more of them into customers and keeping those customers longer. Digital channels touch all three. Reach. Search engines, professional networks and industry newsletters connect you with people already looking for what you sell. Conversion. Clear landing pages, case examples and easy contact options turn interest into conversations. Retention. Email, customer education content and community channels keep existing customers engaged and open to expansion. The underlying ...
Read more

ERP Solution Guide: How to Choose the Best ERP for You

What Is an ERP System and Why Does It Matter? An enterprise resource planning (ERP) system is software that integrates the core functions of a business — finance, inventory, procurement, human resources, manufacturing, and customer management — into a single, connected platform. Instead of data living in separate spreadsheets or standalone applications that don't talk to each other, an ERP creates one source of truth for the entire organization. For growing companies, the question is usually not whether they need an ERP but when and which one. Getting this decision right has long-term consequences. A poorly chosen ERP creates more problems than it solves — forcing teams to work around the system, creating data integrity issues, and consuming IT resources in an endless cycle of customization and maintenance. A well-chosen ERP, on the other hand, becomes the operational backbone that lets a company scale without proportionally growing its administrative overhead. Understandin...
Read more