.svg){kind=logo}
.avif)
%20tmb%20(1).avif)
On this page
Measure the work, not the signal.
See productive time and utilization by team, not just what looks active.
Key takeaways
- Time theft is when an employee is paid for time they didn't actually work, whether by overstating hours, extending unrecorded breaks, or having someone else clock in for them.
- It takes many forms, including buddy punching, timesheet fraud, phantom employees on payroll, and simulated computer activity.
- Time theft is usually an employment matter handled through discipline rather than a standalone crime, though deliberate falsification of records can amount to fraud depending on the jurisdiction.
- Preventing it rests on two things: a clear policy that says what counts, and time data accurate enough to tell a deliberate act from an honest mistake.
Time theft is when an employee is paid for time they didn't actually work. It covers overstating hours, taking longer breaks than allowed, clocking in for someone else, and adding unworked time to a timesheet.
Most time theft isn't malicious. Unclear expectations and unreliable time records are a common culprit. Time theft is a data problem first. When time records reflect real work, time theft becomes foreseeable and preventable.
This guide covers what counts as time theft, the main forms it takes, where the law stands on the questions people ask most, what it costs, and how to prevent it with clear policy and accurate time data.
What is time theft?
Time theft is when an employee is paid for time they did not actually work. It happens when the hours recorded for pay don't match the hours worked, whether through a padded timesheet, an unrecorded break, or an entry someone else made on a colleague's behalf.
The same idea goes by several names. Time stealing, time and attendance fraud, and time clock fraud all describe the same gap between paid hours and worked hours, so a search for a time theft definition or time theft meaning will turn up any of them.
Here's what it can look like in practice. An hourly employee finishes at 4:30 p.m. but knowingly or unknowingly enters 5 p.m. on their timesheet. That half hour seems minor on its own, and becomes a real discrepancy repeated three times a week.
Another employee logs a 30-minute meal break as paid time because the rule on recording breaks was never explained.
Employee time theft can also involve starting late without recording it, extending an unpaid break, or claiming overtime that wasn't worked.
What it doesn't include is ordinary downtime. Nobody works every second of a shift, and short pauses are normal. Getting a glass of water, speaking briefly with a colleague, or stretching for a few minutes isn't misconduct.
The distinction usually comes down to intent, frequency, and expectations. Without accurate records, all of it looks the same on a payroll report, which is what makes time theft at work so hard to detect.
What counts as time theft: examples
Time theft in the workplace takes many forms, from adjusting a timesheet to asking a colleague to clock in for you.
These are the most common examples of time theft:
- Late starts and early finishes. An employee records their scheduled hours even though they regularly begin late or stop before the shift ends.
- Extended breaks. A worker takes more break time than the company allows without recording the extra unpaid time.
- Rounding up timesheets. An employee repeatedly adds a few minutes to their start or finish time instead of entering exact hours.
- Unapproved overtime. A worker intentionally “slow works” to force overtime pay, adds overtime to a timesheet without having worked those hours, or without the approval the policy requires.
- Personal tasks during paid hours. An employee uses substantial work time for personal activities outside company policy, such as shopping, appointments, or freelance projects.
- Buddy punching. One employee clocks in or out for a colleague who isn't present, making it look like the colleague worked more time than they did.
- Simulated computer activity. An employee uses a tool such as a mouse jiggler to keep a computer or an online status looking active while they're away.
Two things separate most of these from ordinary working life.
The first is repetition: a single rounded entry is an error, while the same entry every Friday is a pattern.
The second is whether the person knew: An employee who has never been told that breaks need recording isn't doing the same thing as one who purposely records a 4:30 finish as 5 p.m.
Context matters in all of these. Occasional personal moments are a normal part of any workday, and the concern is a repeated pattern of misrepresenting paid time, not a few isolated minutes spent making coffee.
The main forms of time theft
Some forms are more organized than a long break or a rounded entry. Each of the three below has its own mechanics, and each closes off in a different way.
Buddy punching
Buddy punching is when one employee clocks in or out for another. It creates a false attendance record, making it look like someone started earlier, finished later, or attended a shift they missed entirely.
It mostly affects manual and badge-based systems: punch cards, shared sign-in sheets, and swipe badges. Those systems confirm that a credential was used without confirming who used it, so a badge handed to a colleague works exactly as well as a badge used by its owner.
The way to prevent buddy punching is to remove the separate clock-in action altogether. When time is captured from real work activity rather than from a credential, there's no entry left for a colleague to make on someone else's behalf, and the record reflects who was actually working.
Timesheet fraud and time card fraud
Timesheet fraud is the deliberate submission of inaccurate hours for pay. Time card fraud means the same thing, usually in reference to physical or digital punch records. Both cover padded hours, false entries, altered break times, and manipulated clock-in and clock-out times.
In practice it looks like an employee entering a scheduled start time despite arriving late, adding an hour to several shifts across a pay period, or amending a missed punch without explaining the correction. A supervisor can also approve hours they know are inaccurate, which is harder to spot because the approval itself looks routine.
What makes this harder to spot than buddy punching is that nothing looks unusual. The hours are plausible, the shifts exist, and the person really did work that day. The only signal is the gap between the record and what happened, and manual systems don't produce anything to compare the record against.
These entries are easiest to introduce when people rebuild their week from memory on a Friday afternoon. Our guide to preventing timesheet fraud without micromanaging covers the practical side: reduce manual entry, keep a clear correction process, and make sure genuine mistakes are easy to fix and easy to tell apart from a pattern.
Phantom employees
A phantom employee is a payroll entry for someone who doesn't work at the company, or no longer does. Someone with payroll access creates a fictitious worker, keeps a former employee active, or redirects payments to an account they control.
This is intentional payroll fraud rather than employee behavior, which is why it rarely surfaces through supervision. It surfaces when pay data is reconciled against current employment records and real activity data, because a name drawing salary with no work behind it stands out immediately.
Regular reconciliation is the control, and it surfaces the honest version too: leavers who were never deactivated by mistake.
.avif)
Is time theft illegal? What the law actually says
Time theft is generally treated as an employment matter rather than a standalone crime. Time theft laws as such don't exist in most places: an employer's remedy is usually discipline or termination.
Deliberately falsifying records to obtain pay can rise to fraud or theft depending on the jurisdiction and the amounts involved, but that's the exception rather than a starting point for how to prevent time theft.
Is it a crime or a felony, and can someone go to jail? Rarely, and only in serious cases involving deliberate, sustained falsification. Most employee time theft punishment happens inside the workplace, through a conversation, a warning, or dismissal. Criminal charges depend on the jurisdiction, the evidence, and the sums involved.
Does it apply to salaried employees? The concept applies differently, because pay isn't tied to hours in the same way. Expectations, availability, and completed work matter more than small variations in the clock, so a salaried case usually hinges on whether the work was done rather than on the minutes recorded.
Wage theft and time theft are conceptual opposites. Wage theft is the employer underpaying the employee. Time theft is the employee billing time they didn't work. The two get confused because both produce a gap between hours worked and money paid.
Employer time theft is a real legal obligation. Requiring or allowing staff to work off the clock, or failing to pay qualifying overtime, breaches wage-and-hour law regardless of whether anyone approved the extra hours in advance. The obligation sits with the employer, and it doesn't transfer to the employee by asking them to keep their own records.
Accurate records protect employees here as much as they protect employers, because the same record that shows unworked time also shows unpaid work. An employer who can evidence hours can resolve a claim; an employee who can evidence hours can submit one. That symmetry is the reason record quality matters more than enforcement appetite.
One caution runs through all of this: the answers change by state and by country. What counts as an offense, what an employer may deduct, and what records they must keep all vary, sometimes considerably.
This article is general information, not legal advice. Specific cases belong with a qualified employment lawyer in the relevant jurisdiction.
What time theft costs
The cost of time theft rarely shows up on a single timesheet. A few extra minutes look insignificant on their own, and only become visible once the same discrepancy repeats across a significant period of time.
Take an employee who records 12 unworked minutes a day, five days a week. That's an hour a week. Across 50 working weeks, the employer pays for 50 hours nobody worked. At $20 an hour, that's $1,000 a year for one person. A team of twenty with the same pattern costs $20,000.
Self-reported figures suggest the behavior is widespread. A 2025 Business.com survey of 1,000 workers found that 24% admitted to overreporting hours, extending breaks, or asking a colleague to falsify their time card, adding an average of 4.5 hours per week per worker.
The wider picture is worse. In its 2026 Report to the Nations, the Association of Certified Fraud Examiners estimated that organizations lose about 5% of revenue to occupational fraud each year, with a median loss of $104,000 per case. This report covers occupational fraud in every form rather than time theft specifically, but it shows why small, persistent discrepancies are worth closing early.
Why time theft happens
Most time theft is opportunistic rather than malicious. Controlling for the problems below can nip time theft issues in the bud before they start.
Unclear expectations come first. When nobody has said whether a ten-minute coffee break needs recording, or what counts as a reasonable personal moment, people decide for themselves. They tend to decide generously in their own favor.
Feeling undervalued does the rest of the work. An employee who believes they're underpaid or overlooked may treat a padded half hour as reclaiming something they're owed. That doesn't make the entry acceptable, but it does explain why discipline on its own tends not to change the behavior.
Culture finishes the job. When people watch colleagues arrive late or stretch breaks with no consequence, the behavior stops feeling like a breach and starts feeling like the norm. At that point it's spread through the team rather than sitting with one person, so individual conversations become moot.
Manual systems make it easy. Punch cards, spreadsheets, and shared sign-in sheets rely on memory and individual honesty, and they leave no independent record to check an entry against.
How to prevent time theft
Time theft prevention is mostly about removing ambiguity and opportunity. These five steps do both.
- Write a time theft policy. Define what counts, what doesn't, how time is captured, and what happens when a record and the work don't match. Be explicit about time theft consequences and keep them proportionate: a first discrepancy may warrant a conversation or a written warning, while repeated or deliberate falsification may lead to time theft termination. Say so in advance rather than deciding case by case.
- Set clear expectations around breaks, personal time, and overtime. Say how long breaks should be, whether they need recording, and how to request overtime. Make room for reasonable personal moments and put that in writing, because a policy with too little leeway for personal messaging will be ignored on day one.
- Replace manual time capture with automated, activity-based timesheets. Punch cards, spreadsheets, and sign-in sheets are where buddy punching and padding live, because every entry depends on someone entering it accurately. Timesheets built from real work activity remove that dependency and the opportunities for error or mischief that come with it. They also spare employees the burden of reconstructing a workweek.
- Connect time data to payroll. When the hours that get paid come from the same record as the hours that were worked, the gray area ripe for dispute disappears. Keep an approval and correction process running so discrepancies get resolved before payroll closes rather than after.
- Talk before acting. When a case appears, start with understanding the reason, rather than launching accusations. A missed entry, a schedule change, or a technical fault explains most first cases, and most of them end with clarified expectations rather than discipline. Share the record, let the person respond, and write down what was agreed.
A sample policy paragraph you could adapt:
"At [Organization], time theft means recording or approving pay for time that wasn't worked, including false start or finish times, unrecorded extended breaks, unworked overtime, and clocking in for another employee. Brief personal moments and breaks taken in line with company policy are not time theft. We capture work hours through automated, activity-based timesheets, and employees may request corrections. Discrepancies begin with a conversation. Repeated or deliberate falsification may lead to disciplinary action, including termination."
How Insightful keeps time data accurate
Manual records ask people to remember exactly when they started, stopped, and took breaks, often days later. Even with nobody trying to game anything, that produces errors. Shared punch cards and sign-in sheets add a second problem, because one person can record attendance for someone else.
Insightful is a work data platform, and its Workforce Analytics product captures time automatically from real computer activity. Time and attendance software records clock-ins and clock-outs that reflect when work actually starts and stops, so a timesheet begins from what happened, not from what was scheduled or recalled.
Those records become automated timesheets that replace punch cards, spreadsheets, and manual sign-ins. That closes the main openings for buddy punching and padded hours, because there's no transferable credential to hand over and no blank week to fill in from memory.
The same records protect employees. They document every worked minute, including time before or after a scheduled shift and qualifying overtime that might otherwise go unrecorded. Employee dashboards means employees see the same data their managers see. A discrepancy becomes a conversation with an objective record rather than one person's word against another's.
The result is a timekeeping process built around evidence rather than intention or memory. Employers have a clearer basis for payroll decisions, and employees have a record of the time they actually worked.
Get time data you can stand behind
Policy sets the standard. Accurate data is what makes the standard real, because a rule nobody can verify is a rule nobody follows for long.
Get both right and the arrangement stops being adversarial. Employers pay for the time that was actually worked. Employees are paid for every minute they put in, including the billable hours and minutes that manual systems routinely lose.
With decision-grade data, time theft stops being something you police after the fact and becomes something the record simply doesn't allow. A far cheaper problem to solve, and a much better place to work.
Start a full access free trial to see what accurate work time data looks like.
Frequently asked questions
What is time theft?
Time theft is when an employee is paid for time they didn't actually work. It covers padded timesheets, unrecorded extended breaks, asking a colleague to clock in for you, and claiming overtime that wasn't worked. Inaccurate records and unclear expectations can create the same gap without any deliberate act.
Is time theft illegal?
Time theft is generally an employment matter, handled through discipline or termination rather than the courts. Deliberate falsification of time records to obtain pay can amount to fraud in some jurisdictions, depending on the conduct, the evidence, and the amounts involved. Most cases never reach that threshold.
Is time theft a crime or a felony?
Rarely. Most incidents stay internal, particularly where the discrepancy is small or the intent is unclear. Serious, sustained falsification can lead to criminal charges under applicable theft or fraud law, and whether a charge is a felony depends entirely on the jurisdiction and the sums involved
Can you go to jail for time theft?
Only in serious cases involving deliberate fraud and a conviction under applicable law. The overwhelming majority of time theft cases never involve law enforcement at all, and are resolved through workplace procedures. Any criminal exposure depends on the jurisdiction, the evidence, and the amount of money at stake.
Does time theft apply to salaried employees?
It applies differently. Salaried pay generally isn't tied to hours in the way hourly pay is, so expectations, availability, and completed work matter more than small variations in clocked time. A salaried case usually turns on whether the work was done, not on the minutes recorded.
What is the difference between wage theft and time theft?
The direction of the harm. Wage theft is an employer underpaying an employee, through unpaid overtime or off-the-clock work. Time theft is an employee being paid for time they didn't work. Both create a gap between hours worked and money paid, which is why they get confused.
What is buddy punching?
Buddy punching is when one employee clocks in or out for another, making a worker appear present for time they didn't work. It mostly affects punch cards, shared sign-in sheets, and swipe badges, because those systems confirm a credential was used without confirming who used it.
What are common examples of time theft?
Late starts and early finishes recorded as full shifts, extended breaks left unrecorded, rounded-up timesheets, unworked overtime, buddy punching, and simulated computer activity. Substantial personal activity during paid hours can also qualify. Brief personal moments and ordinary downtime usually don't.
What should a time theft policy include?
It should define what counts as time theft and what doesn't, explain how work hours are captured, set out the correction process, and describe consequences proportionate to the case. The sample paragraph earlier in this article covers the essentials and can be adapted to your organization.
How should an employer respond to time theft?
Understand the cause first. Review the record, ask what happened, and consider whether a missed entry, a schedule change, or a technical fault explains it. Clarify expectations and correct the record, then escalate only where there's repetition or clear intent.
Updated September 2026
.webp)
.webp)
