Stop buddy punching before it reaches payroll.
A badge can be lent and a PIN can be shared; a face cannot. Every check-in becomes a verified, living person at the right place — so the timesheet only pays for hours that were actually worked.
Free for up to 5 employees · 30-day trial on paid plans · no card needed
What is it costing you right now?
Buddy punching rarely shows up as a line item. It shows up as a payroll total that is quietly a few per cent too high, every month. The minutes below are the ones that go missing at the edges of a shift — late starts, early finishes, and check-ins made by somebody else. Put in your own numbers.
Your team
Your yearly saving
after using NCheck
An estimate, not a promise. For comparison, Nucleus Research found that ending buddy punching saved companies an average of 2.2% of gross payroll.
One glance, and the record is already verified.
A worker walks up to the shared tablet at the gate and looks at it. On-device liveness decides whether it is seeing a living person or a photo, a phone screen or a video replay. If it is a real face and it matches an enrolled employee, GPS confirms the device is at the site it is registered to, and the check-in lands in the timesheet with a time, a place and an identity attached. It takes about a second, and nobody touches the screen. If the network is down the station keeps working and syncs when it returns. There is no badge to hand over — so there is nothing to hand to a colleague who is running late.
What it does not do: it does not watch anyone during the day. NCheck records the check-in and the check-out, and nothing in between.
At €6 an hour, one unworked hour a month per employee costs about €72 a year. NCheck Standard for that employee costs €18.
Liveness detection, GPS, geofencing, offline mode and access control are in the plan price — not add-ons and not a separate licence. Face check-in with liveness and GPS is in the free plan as well.
How buddy punching happens with cards, PINs and paper.
Nothing about a card, a fob or a four-digit PIN is tied to a person. It is tied to an object or a number, and both travel. A worker who is twenty minutes from the gate hands a badge to someone already inside, and the clock starts without them. A supervisor keeps a spare fob in a drawer for people who forget theirs, and it gets used for people who are not there at all. A paper sheet is signed at the end of the week from memory, which rounds every shift in the employee's favour. Fingerprint terminals close part of the gap, but a queue of fifty people at a single reader at shift change creates its own pressure to wave people through.
None of this is usually theft in anyone's mind. It is a favour between colleagues, and that is exactly why it is persistent: the person lending the badge feels helpful, the person borrowing it feels covered, and the only party with an interest in the difference is payroll, which finds out a month later and cannot prove anything. By the time the total looks wrong, the evidence is a signature or a card swipe that says nothing about who was holding it.
Worth being honest about: a time clock of any kind only records attendance. It does not tell you whether the hours recorded were productive ones.
Do card or fob clocking terminals not already solve this?
They record that a credential was presented, not who presented it. That is enough for a payroll system to accept the hours, which is the problem — the record looks complete whether or not the right person was there.
What about staff who forget their badge?
With a face check-in there is nothing to forget, so the exception disappears along with the spare-fob drawer that exceptions tend to create.
Does this only matter for large sites?
No. The cost scales with headcount but the gap exists at any size; a ten-person team with a shared PIN has the same unverifiable record as a thousand-person plant.
How face check-in with liveness detection stops buddy punching.
Enrolment takes a photo once and converts it into an encrypted mathematical template. The original image is not kept, and the template cannot be turned back into a face. From then on, a check-in is a comparison: the camera sees a face, the algorithm builds a template from what it sees, and it compares that against the enrolled one. Neurotechnology's face algorithms, which rank among the most accurate in NIST evaluations, do the matching, and the whole exchange takes about a second.
The part that actually closes buddy punching is liveness. Before any match is attempted, on-device liveness detection decides whether the camera is looking at a living person or at a flat reproduction of one — a printed photo, a phone screen, a video replay. This is the step that separates a verified check-in from a photograph of a colleague held up to a lens, and it is tested to the ISO/IEC 30107 standard. A failed liveness check blocks the check-in when it happens; nothing is saved for someone to review after payroll. That distinction matters: a system that quietly stores a questionable photo for a manager to look at later has not prevented anything, it has only created paperwork.
GPS and geofencing close the second half. A check-in carries the location it was made from, and a geofence per site means a check-in made two kilometres away is flagged rather than silently accepted. For a shared station at a gate the location is fixed; for field crews on their own phones it is the thing that makes the record meaningful.
What it does not do: liveness detection reduces spoofing, it does not claim to be unbeatable, and no biometric system is. It raises the effort of faking a check-in from "borrow a badge" to something no colleague does as a favour.
Can someone check in with a photo or a video of a colleague?
That is precisely what liveness detection is for. The check is made on the device before a match is attempted, and a photo, a screen or a replayed video is rejected rather than recorded.
Does it work on the devices we already have?
Yes. A phone, a tablet, a webcam on a PC or an existing IP camera all work. The only thing you might need to buy is a tablet for a gate that has no device at all.
What if an employee refuses to use biometrics?
Give them a PIN, a QR code, an RFID card or a barcode instead — all are supported, and they can be mixed within one workforce. You lose the verification for that person, which is a reasonable trade for consent.
What HR sees: the report that shows who was there, and where.
Every check-in becomes a row with four things attached: who, when, where, and how they were verified. The timesheet builds itself from those rows, applying the work schedules, break rules and overtime settings you configured, so the month-end report is not a transcription exercise. Where a manager has corrected something — a missed check-out, a shift worked off-site — the correction carries a note and the original value stays visible underneath it. Nothing is overwritten silently.
That audit trail is what turns a disagreement into a two-minute conversation. When an employee says they were in at six and the timesheet says seven, you can both look at the same record and see the verified check-in with its time and its location. It also works in the employee's favour at least as often as against it, which matters a great deal for how the system is received on the floor.
From there the data leaves in whatever shape payroll needs: Excel or CSV, a direct export to Tally ERP or QuickBooks Desktop, or through the REST API into whatever you run. Custom columns and calculations are available where your pay rules do not match the defaults.
What it does not do: NCheck is not a payroll system. It produces the verified hours; your payroll software still calculates and pays them.
What if a check-in was missed for a genuine reason?
A manager corrects it in the admin system and the correction is logged with who made it and when. The original record is not erased.
Can employees see their own records?
Yes. Being able to check their own hours is usually what turns the system from something done to staff into something that protects them too.
How does the data get into payroll?
Excel and CSV exports, direct exports to Tally ERP and QuickBooks Desktop, or the REST API. See integrations and API.
Three ways to record a shift.
What each approach actually proves, without the brand names.
| A dedicated clocking terminal | A photo or GPS-only phone app | NCheck | |
|---|---|---|---|
| Who is verified | The card, fob or finger presented | Whoever is holding the phone | The person's face, checked for liveness |
| Where | At that terminal only | Wherever the phone is | At the site, confirmed by GPS and geofence |
| On a failed match | Entry refused, often with no record | A photo is stored for someone to review later | Blocked when it happens; nothing stored for review after payroll |
| Offline | Usually | Usually not | ✓ records locally, syncs later |
| Devices | Proprietary hardware, per door | The employee's own phone | Phones, tablets, webcams, IP cameras, scanners |
| Setup | An installation project | Minutes | Minutes, on a device you already own |
| Masks and helmets | Depends on the modality | Not assessed | Works with both; helmet detection on Premium |
Who this is for — and who it is not.
Best for
- Operations managers on sites where a shift starts at a gate or a back entrance
- HR and payroll teams signing off timesheets they have no way to verify
- Owners and finance leads who can see the payroll total but not what is driving it
Not for
- Teams that want an all-in-one HR suite with attendance as one module inside it
| If this is your situation | The setup is |
|---|---|
| One gated site | A shared station at the gate, plus a geofence |
| Several branches or stores | One shared station per branch, all on one account |
| Field crews with no fixed site | The employee's own phone, with a geofence per job location |
| A mix of both | Shared stations where there is a gate, phones where there is not |
| A queue of 200 at shift change | Several stations on one account, so the line clears in parallel |
"We are using this software across different locations and it just works. A great fit for small and medium-size organisations."
What is buddy punching?
Buddy punching is one employee clocking in or out on behalf of another who is not there. It happens wherever attendance is recorded with something that can change hands — a swipe card, a fob, a shared PIN, a signature on a paper sheet. The hours look legitimate in the system, so they pass straight through to payroll. It is also called proxy attendance, time theft or timesheet fraud, though in practice it is rarely experienced as any of those by the people doing it; it is usually a favour for a colleague running late. The fix is not stricter rules, it is a record that cannot be made by the wrong person.
What to check before you commit.
Worth asking of any system you are comparing, including this one.
- Does a check-in prove a living person was there, or only that a credential was presented?
- Is the location of the check-in recorded, not just the time?
- Does it keep working when the network is down, and sync afterwards?
- Does it run on hardware you already own, or does it require a purchase per door?
- Is the biometric stored as an encrypted template rather than a photograph?
- Can an employee see their own record, and can a correction be audited?
- Are liveness, GPS, geofencing and offline mode in the plan price, or charged separately?
- Can verified hours reach payroll without anyone re-keying them?
Before you ask us.
How does NCheck stop buddy punching?
By making the credential something that cannot be handed over. A check-in requires a live face that matches an enrolled employee, verified on the device, with the location recorded alongside it. There is no badge, fob or PIN to lend.
Can we stop staff clocking in for each other on their own phones?
Yes — this is where liveness and geofencing work together. The face must be live, and the check-in must happen inside the geofence for the site or job. A phone handed to a colleague at a different location fails both tests.
Does it track people during the day?
No. Location is recorded at the check-in and the check-out, and not between them. If you need to answer "who is on site right now", that comes from who has checked in and not yet checked out — not from following anyone.
How do we introduce this without upsetting staff?
Say plainly what is recorded and what is not, show people their own record, and lead with the part that protects them: hours they worked can no longer be disputed or rounded down. Teams that present it as an accuracy measure rather than a surveillance measure get a very different reception, because that is what it is.
Is storing employees' biometric data legal?
It depends on where you operate and usually turns on consent, a stated purpose, retention limits and offering an alternative to anyone who declines. NCheck stores encrypted templates rather than photographs, supports deletion per employee, and can run entirely on your own servers where data must not leave your network. See biometric attendance and the law for guidance by region — general guidance, not legal advice.
What happens if the internet goes down at the gate?
The station keeps verifying and recording locally, and syncs when the connection returns. Nobody waits at the gate and no shift goes unrecorded.
How long does it take to set up?
A cloud account and a first check-in take minutes; enrolling a workforce takes as long as photographing everyone once. If the data must stay inside your network, the on-premises server is an afternoon — see the on-premises quick start.
Keep reading.
Face recognition attendance
How the check-in itself works, on any camera you already have.
Face liveness detection
The step that rejects photos, screens and video replays.
Timesheet fraud
Where unworked hours come from, and what they add up to.
The ROI of biometric attendance
What changes on the payroll line after the first full month.
Manufacturing
Shift changes, contractor crews and gate queues.
Reducing payroll errors
Why verified hours cut corrections as well as disputes.
Pay for the hours that were actually worked.
Free for up to 5 employees, forever. 30-day free trial on every paid plan, no card needed.
Last reviewed: October 2026. Templates, not photos; deleted on request; on-premises keeps everything inside your network. Details on the security and compliance page.