Time Theft: Common Types, Warning Signs, and How to Catch It Before Payday

Key takeaways

• Time theft usually comes from small habits like long breaks, early or late clock-ins, and buddy punching.
• Ten unworked minutes a shift across 200 hourly employees at $20 an hour adds up to roughly $166,000 a year, before payroll taxes.
• The warning signs live in the data: identical punch times, clustered manual edits, and hours that don't match POS or site records.

Time theft is the gap between the hours someone gets paid for and the hours they actually worked, and in most workplaces it has very little to do with anyone trying to take something. It usually looks like a coffee run that never makes it onto the timesheet, or a coworker clocking in for a friend who's stuck behind a school bus. 

Most employees who do these things have never been told it counts as anything. The assumption underneath is pretty reasonable on its face: a business with a few hundred people on payroll isn't going to feel ten minutes here and there. And for one person on one Tuesday, sure, it won't. Spread that over everybody, every shift, 26 times a year, and you get a different story, one that usually shows up as a fuzzy variance on the labor line long after the checks have cleared.

The real cost of time theft for employers

Let's put rough numbers on it. Say you run a retail chain with 200 hourly people making about $20 an hour, and each of them ends up with ten paid minutes a day that weren't really worked (a lunch that ran over, a clock-out that got rounded up a bit). Per person that's around $3.33 a day. Nobody would chase that. Multiply it across the company, though, and you're at roughly $670 a day, which over 250 working days comes to something like $166,000 a year, and then you add employer payroll taxes on top because the IRS doesn't care which hours were real.

If you'd rather see outside numbers, the two that get quoted most come from Nucleus Research, which put the cost of buddy punching at up to 2.2 percent of gross payroll, and the American Payroll Association, which estimated that about three out of four US businesses lose money to it. 

What makes it tricky for a finance team is that you mostly can't see it. A CFO looks at labor cost against revenue, notices the variance is a little off again, and has no way of knowing from that one figure if it's a pay rule somebody set up wrong two years ago or thousands of tiny timekeeping habits across twelve locations. Going punch by punch isn't realistic for anyone. So it just sort of becomes "what labor costs here."

Common types of time theft

Most of what employers run into falls into a handful of patterns, and very few of them start with bad intent.

Buddy punching

This is when one employee clocks in or out for someone else. Nine times out of ten it's a favor. Your friend texts that she's got a flat tire and will be ten minutes late, you're standing right by the terminal, and punching her in feels kinder than letting her get written up. People who do this almost never think of it as time card fraud, though that's usually what the handbook calls it.

Padded or edited timesheets

Anywhere hours get typed in by hand, they drift a little. You forgot to clock out at 5:10, it's Thursday before you notice, and 5:30 feels about right, so that's what goes in. Or someone rounds every start down and every finish up because, well, nobody ever told them to put the actual minute.

Long or unrecorded breaks

The 30-minute lunch that's really 45 is probably the most common one out there, plus the quick breaks that never get punched at all. You see it most where the break rules got explained during onboarding and then never came up again.

Early clock-ins and late clock-outs

Someone gets in 15 minutes early, clocks in out of habit, and then hangs out in the break room until the shift starts. That's paid time. In a hotel or a warehouse with a hundred hourly staff, it can turn into something the whole place does without anybody really deciding to.

Personal time on the clock

Personal calls and errands during paid hours are where this gets gray, because a quick text to check on your kid is a normal part of being a person at work, and treating it like misconduct will cost you more in goodwill than you'd ever save in wages.

Warning signs in timesheets and attendance data

You won't find time theft by watching people, and trying to will make everyone miserable. Look at the data instead. Nobody has to feel watched for that.

Punches that are too tidy are a good place to start. People don't walk in at 8:00:00 every single day, so if somebody's timesheet says exactly 8:00 in and exactly 4:30 out for a month straight, chances are those times are being typed in after the fact. 

Then there's the reverse, two employees who always punch seconds apart on the same clock, where one of them barely appears anywhere else in your systems. If you've ever wondered what buddy punching looks like in a report, that's pretty much it.

Manual edits are worth a look too, particularly when they cluster under one supervisor or at one location, or when missed punches always seem to get corrected in the employee's favor. So is any mismatch between hours and other systems: a server clocked in an hour before the first ticket hits the POS, or a construction crew showing ten hours on a job site that the gate log says they left at two. Same goes for overtime that keeps climbing at one site while sales there stay flat.

Don't jump on any of this, though. A run of identical punches could be a badge reader that's been broken since spring. Lots of edits might just mean that one manager actually fixes mistakes and the others don't bother. You're looking for things to ask about. And a heads-up, even payroll systems with built-in attendance monitoring will usually push these patterns right into the pay run, since all the sync really checks is that the hours showed up.

{{add_protection}}

Legal considerations before acting on suspected time theft

This is where well-meaning employers get themselves in trouble, because the instinct to fix the hours can create a bigger wage problem than the one you started with. Nothing here is legal advice, and anything that ends in a pay adjustment or a termination should go past your employment counsel first. A few rules are worth knowing before that conversation, though.

Under the Fair Labor Standards Act, you have to pay for time that was actually worked, even if nobody approved it. If an employee stays late without permission and works, the Department of Labor's regulations treat that time as compensable, and the fix is discipline under your policy rather than refusing to pay. That's especially true for overtime, which is where overtime compliance software earns its keep by checking the math before payday.

Getting money back after payday is where it gets risky. With non-exempt staff, federal rules won't let a deduction drop someone under minimum wage or take a bite out of overtime they're owed, and plenty of states (California and New York, for two) go further and usually want written authorization first. Salaried exempt people are their own headache. Dock a partial day and you may be poking a hole in their exempt status under the DOL's salary basis rules, and suddenly one discipline issue has turned into back overtime for a whole job title.

Rounding needs care as well. The FLSA allows rounding to the nearest five minutes, tenth of an hour or quarter hour only if it's neutral over time, so a policy that always rounds in the employer's direction is a violation even if it was meant to offset padded punches. California is stricter still, and in Donohue v. AMN Services (2021) its Supreme Court ruled that employers can't round meal period punches at all.

The safe way to handle it is kind of dull, and that's fine. Write down what you found and talk to the person before you take any action. Treat everyone the same under the policy, and fix the timesheet before payroll runs instead of chasing it with deductions later.

How to catch time theft before payroll is finalized

Timing matters more than people expect here, before the pay run, a correction is a timesheet edit and a short conversation. But after it, you're dealing with deduction rules and an employee who has already spent the money.

The cheapest fix also tends to work best, which is a written time and attendance policy that people have actually read. Spell out what counts with real examples (clocking in early and hanging around, punching for a friend) and walk through why ten minutes matters once you multiply it by everybody. Make it easy to fix an honest mistake without getting in trouble for it. A lot of people simply didn't know, and once they do, a good chunk of the problem takes care of itself.

After that, build a checkpoint into every cycle. Supervisors sign off on timesheets before cutoff, and any edit needs a reason plus the employee's OK. Give them an exception report to work from, something listing missed punches, edits, punches way outside the schedule, and overtime that jumped compared with last period, so the approval isn't just a click. If buddy punching is a real pattern at a site, a biometric time clock or geofenced mobile punching will close most of that gap, as long as you get consent right.

The last layer is checking the whole payroll before it's processed, which is hard to do by hand once you're past a few locations. Celery is an AI-powered payroll protection platform that scans each cycle against prior cycles and your pay rules and flags what doesn't fit, like an overtime jump at one site or hours that break an employee's usual pattern, so errors get caught before money moves.