Buddy-punching means one person clocking in for another. On a paper register it is as easy as signing a friend's name. Biometric machines fix the problem but cost money to buy, install, power and maintain, and they only work where they are bolted to the wall.
Layer 1: tie the clock-in to a place
A GPS radius means a person must physically be at the workplace to clock in. A colleague cannot clock you in from home. Set the radius generously (phone GPS drifts 5 to 50 metres) so honest staff are not blocked.
Layer 2: tie the account to a device
Device binding locks each staff account to the first phone it logs in from. If someone shares their password, the second phone is blocked. When a person changes phones, the admin resets the registration in one tap.
Layer 3: make exceptions visible
Remote work should be the exception, with a selfie and an admin approval each time. Records show who clocked in, where and when, so patterns stand out.
Be honest about limits
No phone-based system is unbreakable: a determined person can fake GPS. The goal is to make cheating inconvenient and visible, and to give you evidence when something looks wrong. Combine the layers, review the records, and tell staff what is recorded.
Try Punctual free for 14 days to set up all three layers in minutes.