Buddy punching is when one employee clocks in or out on behalf of another. It leads to inaccurate timesheets, inflated payroll, and compliance risk. Connecteam gives you several layers of protection across both the Kiosk App and the personal mobile app, so you can verify that the person clocking in is who they say they are, and catch it when they are not.
This article brings all of Connecteam’s buddy punching protections into one place. Let’s dive in!
How Connecteam Prevents Buddy Punching
Connecteam tackles buddy punching in two directions:
Verify identity at clock-in. Require a selfie on the shared Kiosk App and on personal phones when a login happens from a new device.
Detect and alert. Flag when someone logs in from a new or unrecognized device, a common buddy punching signal, surface it to admins, and let you automate a response.
You can use these protections on their own or together, depending on whether your team clocks in on a shared Kiosk device, personal phones, or both.
Kiosk Selfie Security
The Kiosk App lets multiple employees clock in and out on one shared device using a personal 4-digit Kiosk Code. Because a code can be shared, selfie security confirms that the person entering the code is the correct employee.
When enabled, every user must take a selfie each time they log in to the Kiosk before they can clock in.
To turn on Kiosk selfie security, follow these steps:
Tap your name or avatar in the top-right corner.
Tap Settings.
Open the Security tab.
Turn on Require users to take a selfie image when logging in to the Kiosk app.
Tap Save changes.
Here is how it works for employees:
The employee enters their Kiosk Code on the login screen.
The camera opens and they take a selfie.
They tap Confirm and login to complete the login and clock in.
Auto Log-Out Due to Inactivity on the Kiosk
Employees sometimes forget to log out of the shared Kiosk, which leaves their account open for the next person. Auto log-out closes that gap by signing users out after a period of inactivity.
To turn on auto log-out, follow these steps:
Tap your name or avatar in the top-right corner, then tap Settings.
Open the Security tab.
Turn on Log out Kiosk users if they are inactive for more than X minutes.
Set the number of minutes.
Tap Save changes.
If a user is inactive longer than the time you set, an Inactivity detected pop-up appears. The user must tap Yes, keep me logged in within 15 seconds, or the Kiosk logs them out automatically.
New Device Selfie Verification on the Mobile App
For teams that clock in on personal phones instead of a shared Kiosk, Connecteam can require a selfie when an employee logs in to the mobile app from a new or unrecognized device. This is the mobile equivalent of Kiosk selfie security, and it directly targets buddy punching where one employee logs in on a coworker’s phone.
When enabled, if a login is detected from a new device, the app shows a blocking screen and the employee cannot access the app until they take a selfie.
To turn on new device selfie verification, follow these steps:
On the desktop, go to your General Settings in the top-right corner.
Open the Security tab.
Turn on the option to Require selfie on new device login.
Click Save changes.
Here is how it works for employees:
The employee opens the app on a device Connecteam does not recognize.
A blocking screen appears before they can reach the app.
They take a selfie using the same camera screen used on the Kiosk.
Once the selfie is submitted, they gain access to the app.
A few things to keep in mind:
The selfie is not required on a user’s very first login, because there is no known device yet to compare against. It is triggered from the second login onward, when a new device is detected.
This does not apply in Kiosk mode, where everyone shares the same device. Use Kiosk selfie security there instead.
The block persists every time the app is opened until the selfie is provided. An admin can also release the user by clearing the alert, as described in the next section.
New Device Alerts and How Admins Manage Them
Whenever an employee logs in from a new or unrecognized device, Connecteam creates a new device alert. This is one of the clearest signals of possible buddy punching, so it is worth reviewing regularly.
To view and manage new device alerts, follow these steps:
Go to the Overview page in your admin dashboard.
Find the alert indicating that users have logged in from a new device, for example “14 users have logged in from a new device”.
Open the alert to see the list of flagged users, including the previous device and the new device.
Review each entry. If the login is legitimate, clear or dismiss the alert to remove the flag.
When new device selfie verification is enabled, clearing a user’s alert is also how you release a blocked employee so they can access the app again. If a selfie was captured during the new device login, it is attached to the alert so you can verify the person before clearing it.
Where to View Selfies
Selfies captured at login, whether on the Kiosk or from a new device, can be viewed in two places.
To view a selfie from the user’s profile, follow these steps:
Go to Users.
Click the relevant user to open their profile.
Open the Activity tab.
Find the event showing the user logged in.
Click the camera icon to view the selfie.
To view a selfie from the user’s timesheet, follow these steps:
Go to the relevant Time Clock.
Open the user’s timesheet.
View the selfie by hovering over the Start and End times, or by adding the columns Start, selfie and End, selfie.
💡 Tip: Adding the selfie columns to a timesheet gives you at-a-glance visual confirmation for a whole pay period, which is faster than checking profiles one by one when you are reviewing timesheets before payroll.
Automate Your Response with Buddy Punching Triggers
Beyond detection, you can use Connecteam's Automations feature to automate what happens when buddy punching is suspected, using two of the automation triggers.
User Logged In From New Device: Fires whenever an employee logs in from a new or unrecognized device. Use it to notify a manager, send a security alert, or tag the user for review.
Is Buddy Punching: Fires when an employee clocks in while they have an open new device alert, the strongest buddy punching signal. Use it to alert a manager, flag the user, or create a compliance record automatically.
Both triggers pass along context such as the user who clocked in, the old and new device details, and the timestamp, so your automated notification can include the specifics.
Learn more about using automations here.
💡 Tip: Pair the Is Buddy Punching trigger with a chat or push notification to a manager so suspected buddy punching gets a same-shift response, instead of being caught days later during payroll review.
FAQ
What Exactly Counts as a New Device?
Connecteam identifies each device by a unique device ID. When an employee logs in from a device ID it has not seen for that user before, it treats it as a new device and creates an alert.
Does the Selfie Requirement Trigger on a User’s First Login?
No. There is no known device to compare against on the first login, so the selfie is only required from the second login onward, when a different device is detected.
An Employee Reinstalled the App and Is Being Asked for a Selfie Again. Why?
Uninstalling and reinstalling the app changes the device ID, so Connecteam sees it as a new device and requests a selfie again. This is expected behavior.
How Do I Unblock an Employee Who Is Stuck on the Selfie Screen?
Either have the employee take the selfie to unblock themselves, or, as an admin, clear their new device alert from the Overview page to release them.
Can I Use Both Kiosk Selfie Security and Mobile New Device Verification?
Yes. If some employees clock in on a shared Kiosk and others on personal phones, enable Kiosk selfie security for the Kiosk and new device selfie verification for the mobile app.
Where Can I Confirm Who Logged In on Whose Device?
Open the new device alert from the Overview page. It shows the flagged user along with the previous and new device details, and the captured selfie when available.
**Kiosk Selfie Security and New Device Selfie Verification are available on the Expert plan (any hub).
**Auto Log-Out Due to Inactivity is available on the Advanced plan (any hub).
**The buddy punching automation triggers are available with the Time Clock automations.
Related Articles
Need more guidance? 🙋 Our LIVE support team (at the bottom right corner of your screen) replies to ANY question.