Time theft is when an employee is paid for time they haven't actually worked; anything from clocking in a few minutes early to having a colleague punch in on their behalf. It ranges from deliberate fraud like buddy punching to habitual slips like overlong breaks, and for shift-based businesses it quietly drains payroll every single week.
For hospitality, retail, and services teams, the problem is sharper than most. Hours are logged across multiple people, locations, and shifts, so small discrepancies compound fast. By the time a payroll error surfaces, the money is already gone.
US employers are estimated to lose billions of dollars a year to time theft, and UK and EU businesses face the same dynamic, they just measure it less. This guide covers the 11 most common types of time theft, what the consequences look like for your business, and the practical steps that stop it, including where automated time tracking removes the opportunity entirely.
What counts as employee time theft? The 11 most common types
Time theft isn't always deliberate. Some forms are calculated: an employee who routinely clocks in before they arrive, or asks a colleague to punch out for them at the end of the day. Others are habitual; an extended lunch that nobody ever challenged, or a slow drift into personal tasks on work time. All of them have the same result: you're paying for time that wasn't worked. Here are the eleven to know.
Buddy punching
Buddy punching happens when one employee clocks in or out on behalf of another, usually to cover for someone who is late, leaving early, or not on site. It's one of the most common forms of time theft in shift-based environments, and one of the hardest to spot without the right controls in place.
Buddy punching is widespread: the American Payroll Association has long estimated that around 75% of US businesses are affected by time theft in some form. Per-employee cost figures get quoted a lot (you'll often see numbers like $1,560 a year) but these are illustrative calculations based on assumed padded hours, not measured losses. Treat them as an order-of-magnitude signal, not a precise benchmark.
The fix is removing the opportunity. Time tracking with geofenced clock-ins means employees can only log hours when they're physically on site: no proximity to the workplace, no clock-in.
Time clock manipulation
Time clock manipulation is when employees deliberately alter their clock-in or clock-out times; rounding up start times, pushing back end times, or editing timesheets after the fact to inflate hours worked.
This is distinct from buddy punching in that the employee is present, but the recorded hours don't reflect reality. It tends to happen where timesheet edits aren't audited and managers sign off on hours without reviewing them against the schedule. The counter is a setup where edits leave a visible trail and any deviation from the scheduled shift surfaces automatically for review, the mechanics behind reducing time card fraud at work.
Unauthorised or extended breaks
This is one of the most common (and most normalised) forms of time theft. An employee takes a 25-minute lunch instead of 20. A cigarette break stretches to 15 minutes. Over a week, across a team of 15, that adds up to hours of paid time that wasn't spent working.
Extended breaks are usually cultural: if it's never been challenged, employees don't see it as a problem. Clear break policies in your staff handbook, consistent write-ups for repeat issues, and automatic break deductions in your time tracking setup remove the ambiguity.
Unauthorised overtime
Unauthorised overtime is the flip side of extended breaks, employees working beyond their scheduled hours without approval. It pushes up your labour costs without any planned or sanctioned increase in output.
It tends to happen when managers have no real-time view of who is clocked in, or when employees know that worked hours get paid regardless of whether they were authorised. Attendance systems that flag hours worked outside the scheduled window give managers the visibility to act before it hits payroll.
Ghost employees
Ghost employees are fraudulent payroll entries, fictitious people added to payroll to divert funds to whoever created them. This is more of a fraud problem than a day-to-day time theft one, and it usually involves someone with payroll access and weak checks and balances.
Prevention relies on separation of duties (whoever adds employees to payroll shouldn't be the same person who approves it), regular audits, and secure access controls. For most small and mid-sized businesses, this is a risk to be aware of rather than a common occurrence.
Personal activities during paid work hours
Browsing social media, online shopping, taking personal calls, running errands on the clock, this is cyberloafing, and it's widespread. Studies suggest it's one of the most financially significant forms of time theft in office and hybrid settings, even if it feels less deliberate than the rest.
For shift-based businesses, the equivalent is staff spending paid time on their phone, socialising well beyond what's reasonable, or disappearing from their station. The line between acceptable and problematic isn't always clear, which is why setting expectations matters as much as monitoring.
Misuse of time off and sick leave
Employees who call in sick when they're not, or who exploit flexible leave policies, are effectively getting paid for time they haven't worked. This is a more sensitive category, because it's hard to separate genuine illness from dishonest absence without breeding a culture of suspicion.
The practical approach is robust absence management that makes balances and patterns visible, so anomalies (always off on a Monday, consistently sick before a bank holiday) can be spotted and addressed early.
Working off the clock
Working off the clock (staff doing work-related tasks outside their clocked hours without logging the time) is technically the employer's problem, not the employee's. In most jurisdictions, including the UK, workers must be paid for all hours worked, including those outside scheduled shifts.
The risk: if employees regularly answer messages after their shift or set up before they clock in, you may owe back pay, and the liability sits with you. The fix is a clear policy and a clocking system that makes it easy to log all time worked accurately.
Task padding
Task padding is when employees deliberately slow their pace or overstate how long a task takes, to fill a shift or inflate billable hours. It's most common where output is hard to measure directly: maintenance, administration, project work.
It's one of the harder types to detect because it rests on subjective judgement. The practical response is clear performance expectations, regular output reviews, and a culture where workload is discussed openly rather than gamed. It often overlaps with padding hours on the timesheet itself.
Time theft by proxy
A less commonly named but real pattern: an employee delegates their work to a colleague, then claims the time and credit themselves. In shift-based settings, that might look like a senior team member handing their tasks to a junior and clocking a full day for light oversight. Clear role definitions and a manager who knows what each person actually does each shift are the best controls.
Inflated mileage and travel expenses
Employees who exaggerate mileage claims or overstate travel time are stealing from company funds in a different way, through expenses rather than timesheets. For businesses with field staff or delivery roles, this is worth auditing. GPS tracking for work vehicles, required receipts, and automated mileage logging all reduce the opportunity for inflation.
What are the consequences of employee time theft?
Time theft hits a business in several compounding ways.
-
Financial losses. The direct cost is significant. Even a few minutes per employee per day adds up to thousands in unnecessary payroll spend across a year.
-
Compliance risk. In the UK, inaccurate timekeeping isn't only an operational headache, it's a legal exposure. Employers must keep accurate records of hours worked under the Working Time Regulations. And since 2025, the "failure to prevent fraud" offence under the Economic Crime and Corporate Transparency Act means larger organisations can be held liable if they haven't taken reasonable steps to prevent fraud such as falsified timesheets. Poor records leave you exposed to wage-and-hour claims regardless of who caused the discrepancy.
-
Reduced productivity and morale. Time theft doesn't just cost money. Honest employees notice when colleagues get away with it, and that erodes trust across the team. The culture of dishonesty tends to spread.
-
Reputational and operational cost. If time theft escalates to formal disciplinary action or legal proceedings, the disruption is real. Prevention is far cheaper than enforcement.
How do you prevent employee time theft?
Preventing time theft is less about surveillance and more about removing the conditions that make it possible. Here's what actually works.
Set clear expectations from day one
A time and attendance policy in your staff handbook (covering break lengths, clock-in procedures, and the consequences of manipulation) removes the ambiguity that normalises minor theft. Employees who understand what's expected are less likely to push boundaries, and you have a documented basis for action if they do.
Use time tracking with accountability built in
The single most effective prevention measure is a setup where clock-ins are tied to location, edits leave a visible trail, and anomalies surface on their own.
Run regular audits
Periodic reviews of clock-in and clock-out records (looking for patterns like consistent rounding, unusually high overtime in specific teams, or repeat discrepancies on particular days) catch problems before they become habits.
Address issues promptly and consistently
A verbal warning for a first incident and a written warning for a repeat offence is a reasonable framework, escalating to dismissal for serious or persistent cases. The key is consistency and documentation: if time theft is tackled for some employees but overlooked for others, the policy loses credibility and a clear, documented process gives you the strongest position if a dismissal is later challenged.
Build a culture of accountability
Employees who feel fairly treated, clearly managed, and part of the team are less likely to steal time. Giving people visibility into their own recorded hours reduces disputes and builds the mutual trust that makes time theft less attractive in the first place.
Stop time theft before it compounds
For most shift-based businesses, time theft isn't a dramatic fraud problem, it's a slow drain. A few minutes on every clock-in, breaks that run long, timesheets nobody scrutinises, and hours that aren't tracked accurately across the team. Individually the amounts are small. Across a team, over months, they're significant.
The most effective response isn't heavy-handed monitoring. It's building a setup where accurate timekeeping is the easy default: employees clock in the same way every shift, managers review exceptions rather than every entry, and any manipulation leaves a visible trail.
Shiftbase connects employee scheduling, time tracking, and absence management in one platform. Employees clock in from the app, a shared tablet, or the browser; hours flow straight to timesheets; and managers approve and export to payroll without re-entry. Geofenced clock-ins on Premium verify location automatically, and every timesheet edit leaves an audit trail, so the conditions that make time theft easy simply disappear.
Try Shiftbase free for 14 days — no credit card required. Or compare the pricing page and see the industries we serve.
- Easily clock in and out
- Automatic calculation of surcharges
- Link with payroll administration
