Employee time theft is any time an employee is paid for time they did not actually work — and in field-service companies it rarely looks like laziness. It looks like a punch from the parking lot, a 40-minute lunch recorded as 30, a timesheet edited on Friday, or a name on the payroll that no supervisor can put a face to. In a July 2026 Centiment survey of 831 hourly workers commissioned by OnTheClock, 43% admitted adjusting reported hours to misrepresent time actually worked, and 17% said they do it weekly or daily.
This guide covers the six forms of time theft that show up in cleaning, security, construction, and facilities crews — early punching, rounding games, inflated breaks, off-site punching, timesheet padding, and ghost employees — with realistic cost math for each and the specific report or control that catches it. Buddy punching, the seventh form, gets its own treatment in our buddy punching guide.
Two rules before you act on any of it: you generally cannot fix time theft by docking pay (New York Labor Law §193 does not list "suspected theft" among permitted deductions), and if your system captures exact punch times, rounding those punches is now legally risky in some states. Detection, documentation, and discipline are the lawful path — the details are below.
What counts as employee time theft?
Time theft means an employee receives wages for time they did not work or misrepresents their work time — padding a timesheet, taking unrecorded breaks, having someone else punch for them, or simply not being where the clock says they are. It is an operational term, not a legal one: no federal statute defines "time theft," and prosecutions are rare outside of organized payroll fraud. In practice it is handled as a performance and discipline issue, backed by whatever time records you can actually defend.
The legal backdrop cuts both ways. Under the Fair Labor Standards Act, an employer must pay for all hours an employee is "suffered or permitted" to work and must keep accurate records of them. That means the same time clock that protects you from inflated hours also obligates you: if someone genuinely worked through lunch, you owe the time even if policy said not to. Companies that win time disputes are the ones whose punch data is precise enough to show what actually happened, minute by minute.
How much does time theft actually cost?
Be skeptical of the headline numbers in most articles on this topic. The "$400 billion a year" and "employers lose 20% of every dollar" figures repeated across the internet trace back to decades-old estimates that no current primary source supports. The verifiable picture is smaller but still expensive: the ACFE's Occupational Fraud 2024 report puts the median payroll-fraud scheme at $50,000 in losses over a median 18 months before detection, and the 2026 OnTheClock survey found 45% of hourly workers have clocked in while not actively working.
The math that matters is your own. A labeled hypothetical: a 12-person cleaning crew at $18/hour, each averaging 15 padded minutes per workday, leaks 12 × 0.25 hours × $18 = $54 per day — roughly $14,000 per year at 260 workdays, before payroll taxes. If the padding lands in weeks where workers cross 40 hours, every stolen minute bills at time-and-a-half, and if you invoice clients from those same hours on cost-plus contracts, you are passing inflated costs to customers who may eventually audit you. Fifteen minutes a day per person is not an aggressive assumption; survey after survey finds hourly workers admitting to more.
Form 1: Early punches and punch-and-wait
The pattern: workers punch in the moment they arrive — 10 or 15 minutes before the shift — then sit in the break room or their car until start time. Ten minutes a day is 43 hours a year per worker, billed at full rate.
Federal law is on your side here if you handle it correctly. Under 29 CFR 785.48(a), early or late clock punching "may be disregarded" when the employee voluntarily arrives early and does not work. The trap is the second clause: if the early-punching worker starts pulling supplies or loading the van, that time is compensable no matter what the schedule says.
Detection: run a weekly punch-versus-schedule variance report. Any worker whose actual punches consistently run 10+ minutes ahead of scheduled start is either working unapproved time you owe, or punch-and-waiting. Either finding needs a conversation. Prevention is simpler: a time clock that enforces scheduled start times or flags early punches for supervisor approval removes the ambiguity entirely.
Form 2: Rounding and grace-period gaming
The pattern: your system rounds punches to the nearest quarter hour, and workers learn the windows. Under the common "7-minute rule," a punch at 8:07 rounds to 8:00 and a punch at 4:53 rounds to 5:00 — so a worker who games both edges collects up to 14 unworked minutes every day, about 60 hours a year.
Rounding itself is legal under federal law: 29 CFR 785.48(b) permits rounding to the nearest 5 minutes, tenth, or quarter hour — but only if it does not, over time, fail to pay employees for all time actually worked. And the practice is under real legal pressure where systems capture exact punches: in Camp v. Home Depot, a California Court of Appeal held in 2022 that an employer that tracked time to the minute could not use neutral rounding that underpaid the plaintiff; the California Supreme Court agreed to review the issue in February 2023, and the appellate reasoning has been the practical guidance since. New York has no equivalent ruling, but the direction of travel is clear everywhere.
Detection and fix in one move: if your time clock records exact punch times, pay from exact punch times. Rounding exists to simplify math that software already does. Paying to the minute eliminates the gaming window, removes a litigation theory, and — worth knowing — usually costs less than quarter-hour rounding was costing you.
Form 3: Inflated breaks
The pattern: a 30-minute unpaid lunch that reliably runs 45, or paid smoke breaks that multiply. Fifteen extra unpaid-lunch minutes recorded as worked costs the same as any other padded 15 minutes — the hypothetical crew above, again, is leaking about $14,000 a year.
Know the federal floor before you tighten anything: short rest breaks of roughly 5 to 20 minutes are compensable work time under 29 CFR 785.18 — you cannot dock them — while bona fide meal periods (ordinarily 30+ minutes, fully relieved of duty) are unpaid under 29 CFR 785.19. The dangerous shortcut is the automatic 30-minute lunch deduction: if workers sometimes eat in 20 minutes while watching a lobby post or answering calls, the auto-deduct is creating unpaid work time and wage-claim exposure, not savings.
Detection: require actual punch-out/punch-in for meal periods rather than auto-deductions, then run an exceptions report for meal breaks that run long, run short, or vanish. Long-break patterns are a discipline conversation; missing or too-short meal punches are a compliance problem you want surfaced before an auditor finds them.
Form 4: Off-site punching
The pattern: mobile clock-in from home, from the car, or from the coffee shop two blocks from the site. The shift starts when the phone says so, not when the worker reaches the building. At 10–20 minutes per day per worker, this is one of the largest leaks in distributed field operations — and it is invisible on a paper timesheet or a bare mobile app.
Detection: location-anchored punching. GPS geofencing rejects or flags punches that originate outside a radius around the job site; a fixed tablet kiosk at the site makes off-site punching physically impossible; QR checkpoint scans prove presence at specific locations during the shift, not just at its edges. Employers may lawfully verify work location at clock-in — the key is disclosure: tell workers in writing what is collected and when. Punch-time location capture at the job site is a far narrower intrusion than continuous tracking, and it is the version workers accept.
One caution from the 2026 survey worth internalizing: 66% of hourly workers said more monitoring would not change how they spend time. Surveillance does not fix culture. What location-anchored punching does do is make the recorded time truthful — which is all a time system owes you.
Form 5: Timesheet padding and after-the-fact edits
The pattern: hours written on paper at week's end, or digital timesheets edited after the fact — the 43%-admit-it problem. Memory is generous; Friday reconstructions of Tuesday reliably round up. Where supervisors submit crew hours, padding can also be collusive: a foreman adds an hour for the crew, the crew stays loyal to the foreman.
Detection: eliminate self-reported hours wherever work happens at a known place and time — punches, not timesheets, should be the source of truth. Where edits are legitimately needed (a forgotten punch-out), require that every edit be logged with who changed what, when, and why, and review the edit log weekly. A supervisor whose crews need many manual corrections, week after week, is your first audit target: either the punching process is broken at that site or the numbers are being managed.
Form 6: Ghost employees
The pattern: a worker who exists only on the payroll — a terminated employee never removed, a fabricated hire, or a real person who never shows up — with pay flowing to an account controlled by whoever maintains the roster. This is the rare form of time theft that is unambiguous payroll fraud, and it is the most expensive per incident: the ACFE's 2024 report found payroll schemes appear in about 10% of occupational fraud cases with that $50,000 median loss, running a median of 18 months before detection. Distributed field companies are structurally exposed: when workers are spread across 30 buildings, no one person can eyeball the whole workforce.
Detection: reconcile quarterly — every name on the payroll export must match a real onboarding record, a real punch pattern, and a supervisor who can identify the person. Red flags: employees with no punch variance (perfectly identical hours every day), pay deposited to an account shared with another employee, and workers no supervisor can place. Identity-verified punching (a selfie face check or per-worker PIN at a site kiosk) closes the loop, because a ghost cannot stand in front of a camera. Separating who runs payroll from who approves hours removes the single point of control that ghost schemes require.
What about buddy punching?
Buddy punching — one worker punching in for an absent coworker — is the best-known form of time theft, and by the 2026 survey it remains common: 1 in 4 hourly workers admitted clocking in or out for a co-worker in the past year, even though 71% knew their employer prohibits it. We cover the mechanics, costs, and countermeasures in depth in Buddy Punching Is Costing You More Than You Think, so this article simply notes where it fits: it is the identity-fraud member of the family, and the fix — verified identity at punch time — is the same control that kills ghost employees.
Why you can't just dock pay for stolen time
The instinct when you catch padding is to deduct it from the next check. In New York that instinct creates a second legal problem: Labor Law §193 permits only narrow, enumerated wage deductions (insurance premiums, pension contributions, and similar, with written authorization) — recouping suspected time theft is not on the list, and unlawful deductions carry their own liability. Federal law adds a floor: deductions cannot cut a nonexempt worker below minimum wage for hours actually worked.
The defensible sequence is different: correct the record going forward, so future paychecks reflect verified time; discipline under a written policy that names falsification of time records as a terminable offense; and document the punch evidence behind the decision. If the amounts are large enough to matter — a ghost employee scheme, months of collusive padding — that is a conversation with your attorney about civil recovery, not a payroll adjustment you make yourself.
A weekly 15-minute detection routine
You do not need forensic audits to catch five of the six forms — you need the same three reports every week. First, punch-versus-schedule variance: who consistently punches early, late, or long, by more than 10 minutes? That surfaces early punching, break inflation, and rounding games at once. Second, the edit log: every manual timesheet correction, grouped by supervisor — recurring correction clusters are your padding signal. Third, location exceptions: every punch flagged outside a geofence or missing a site checkpoint. Add the quarterly ghost reconciliation — payroll names against onboarding records and supervisor identification — and each form on this list has a report that catches it.
The reason most owners never run this routine is that their time data lives in three places: an app, a spreadsheet, and a shoebox of paper timesheets. This is the problem StockPoint was built around: a tablet kiosk at each site takes punches with a 6-digit PIN, selfie face check, and GPS geofencing, so every punch is identity-verified and location-verified at the moment it happens — and the variance, edit, and exception patterns are visible in one place instead of reconstructed after payroll closes. See how the verified time clock handles punch verification for multi-site crews.
Whatever system you use, the sequencing matters: announce the policy first, in writing, in the languages your crew reads; verify punches second; discipline from evidence third. Workers who believe the clock is accurate for everyone — including the ones it protects on the days they worked through lunch — stop treating the edges of shifts as negotiable.
Is time theft illegal, and can I fire someone for it?
Falsifying time records is grounds for termination in every state, and in at-will states you may generally terminate for it without proving intent — though you should document the punch evidence anyway, both for unemployment-claim disputes and because a termination backed by records is far harder to recast as retaliation. Criminal prosecution is realistic only for organized schemes such as ghost employees, where wage amounts and fabricated records support fraud charges. For ordinary padding, treat it as a documented conduct issue, not a courtroom matter.
Is it legal to require GPS or a face check at punch-in?
Generally yes for the punch-verification model described here — capturing location and a photo at the moment of clock-in on a workplace device, with written disclosure. What draws legal trouble is continuous off-duty tracking and undisclosed collection, and biometric data carries specific statutory duties in some states (Illinois' BIPA most famously; New York does not currently have an equivalent private right of action but does restrict fingerprinting under Labor Law §201-a — photo-based face checks at punch are the widely used approach). Put the practice in your handbook, get written acknowledgment, and collect only at punch events.
How common is time theft, really?
More common than most owners assume, and more casual: in the July 2026 Centiment/OnTheClock survey of hourly workers, 83% admitted spending at least some paid time on personal matters, 48% spend 30+ minutes daily on personal tasks, 43% have adjusted reported hours, and 1 in 4 have buddy-punched within the year. The honest conclusion is that some slippage is human and universal — the ten-minute personal call is not what sinks a contract's margin. The forms worth engineering against are the systematic ones this article covers, because they compound daily and concentrate in exactly the distributed, hourly, multi-site operations that field-service companies run.
This article is general information for business owners, not legal advice; wage-and-hour and biometric-privacy rules vary by state and change over time, so confirm your time-tracking, deduction, and discipline practices with an employment attorney before acting.