Catching Buddy Punching on a Metro Construction Project

The client is a construction consortium delivering a metro line through the heart of a major European city. That means dozens of active sites, underground stations and shafts, and over 1,200 people passing through the gates in a year. Workers used a timekeeping system to clock in and out. Anyone entering a site also went through an access-control gate. Nobody had ever compared the two.

This opened the door to two forms of abuse. One is buddy punching, where an employee clocks in or out for a colleague who is absent. The other is employees recording more hours than they actually worked. The company ordered an internal audit to measure how widespread both were.

What was at stake

• Wages for work never done. Each false stamp is paid as a real hour, with employer contributions on top.
• Too big to see. Nobody can compare 1.4 million gate events and 61,000 daily time records a year by hand.
• Safety and security on site. On a live underground construction site, someone logged as present who is absent, or the other way round, is a serious problem.
• Bad habits spread. When abuse is never caught, it grows, because colleagues notice nobody challenges it.
• Harder to defend costs. Where labour cost is passed through and disputed, padded hours weaken every number the company needs to stand behind.

For the first time, the audit team had something it could never have built manually: each suspect clock-in placed next to the gate record that either backs it up or contradicts it.

• Roughly 14% of reviewed employees displayed malicious clocking behaviour.
• Several hundred hours paid for but never worked came to light over the review period. With construction labour costing about €24 an hour on average, we estimate that at around €7,000-€22,000.
• 13 months of timekeeping reconciled against 1.4 million gate events, which no one could do manually.
• Case-by-case evidence to support the internal audit investigation.

What teams tend to overlook

A timekeeping system confirms that a badge was used. It does not confirm who used it. Fraud that depends on a colleague's help looks entirely normal in each individual record. It becomes visible only when records are compared against each other and against a second, independent system. The second pitfall is the law on employee monitoring. Checking staff is regulated, GDPR among other rules, so the analysis must use records the company already holds lawfully, under an audit mandate, and people must review the findings before any action is taken.