Punchly
All guides
Security 5 min read

Prevent buddy-punching

Catch off-site and fraudulent clock-ins with location flagging, photos, and the activity log.

“Buddy-punching” — one employee clocking in for another, or clocking in before they’ve actually arrived — is the classic weak spot of any time clock. Punchly gives you three layers to catch it, and you can use any combination that fits your workplace.

1. Location flagging with an expected IP

Every workplace can have an expected IP address — the public network the kiosk sits on. When someone clocks in, Punchly compares where the punch came from against that address. Anything that doesn’t match is flagged, so a clock-in from home or a phone’s mobile data stands out.

  1. Open the Workplaces page and edit a location.
  2. Set its Expected IP. Punchly can fill this in for you from the location’s recent kiosk activity — one click, no networking knowledge needed.
  3. From then on, off-network punches are marked as flagged for that workplace.
Set the expected IP once — Punchly can adopt it from recent activity.
Expected-IP checks assume the kiosk stays on one network (typically the site’s Wi-Fi). If a location’s connection changes, just re-adopt the new address from recent activity.

2. Photos at clock-in and clock-out

Turn on photo capture in Company settings and the kiosk quietly takes a photo in the same tap as the punch. It’s captured on the device’s camera and stored privately — only you, the owner, can view it, through the Hours page. A quick glance confirms the right person actually clocked in, which makes buddy-punching far harder to get away with.

Each punch can carry a photo — visible only to you.

3. The kiosk activity log

The Activity page is a complete, filterable record of every clock-in attempt — PIN and QR, successful, failed, or flagged. Filter by employee, workplace, IP, or date to investigate anything that looks off. If you spot a legitimate new network in there, you can adopt it as the workplace’s expected IP in one click.

Put it together

  • Low-touch: set an expected IP per workplace and glance at the dashboard’s off-location alert.
  • Higher assurance: add photo capture so every punch has a face attached.
  • When something looks wrong: open the activity log, filter to the employee or location, and see exactly what happened.
Switching to QR badges instead of typed PINs also helps: a badge is harder to hand off in the moment than a four-digit number a coworker already knows.