Proxy punching is a form of identity fraud where one person clocks in or out for another person using a timekeeping system. It usually relies on shared credentials, a borrowed badge, or an unattended terminal, so the control problem is weak authentication at the point of attendance capture.
What Proxy Punching Means in Practice
Proxy punching is an attendance fraud pattern, not a technical vulnerability in the usual software sense. The abuse happens when a worker is recorded as present by someone else, which undermines timekeeping accuracy, payroll integrity and attendance-based accountability. Because the behavior often looks like an ordinary clock-in event, it is easy to miss without stronger identity checks at the point of entry.
The key distinction is that the system is being used correctly from a workflow perspective, but by the wrong person. That makes the problem especially relevant in workplaces that still rely on shared badges, shared passwords or unattended kiosks. The control failure is usually not the clocking platform itself, but the weak assurance that the person presenting the credential is the person whose attendance is being recorded.
How Proxy Punching Happens
Proxy punching usually succeeds through convenience and trust gaps. A colleague may share a badge, hand over a PIN, or ask another person to clock them in before a shift starts. In some environments, a terminal left unlocked is enough for someone else to act on behalf of the absent worker. The fraud can also be repeated at clock-out, which makes hours worked appear legitimate even when the attendance record is false.
This is why the term is best understood as a form of identity fraud in an operational system. The underlying risk is weak binding between the person, the credential and the event. If the attendance process only validates possession of a badge or knowledge of a password, it may not detect that the wrong individual is using that access path.
Why Weak Authentication Makes It Possible
Proxy punching becomes feasible when the attendance control only proves that some credential was used, not that the authorised employee was physically present. Shared credentials collapse accountability because the system can no longer distinguish between a legitimate clock-in and a proxy event. Unattended terminals and simple badge readers create the same exposure when no second check exists at the moment of use.
In security terms, the issue is weak authentication at a point where identity matters. That makes the event harder to dispute after the fact, because the record may appear valid in the system even though the human action behind it was fraudulent. Over time, that can distort labour records, weaken supervisory trust and make downstream investigations more difficult.
Organisational Consequences and Control Implications
Proxy punching affects more than payroll leakage. It can distort overtime calculations, staffing analytics, disciplinary processes and compliance records tied to attendance. In regulated or safety-sensitive environments, inaccurate presence records can also complicate incident reconstruction, supervision checks and duty-of-care obligations.
Controls should therefore focus on reducing the chance that one person can use another person’s attendance factor without detection. Stronger identity assurance at clock-in, anti-sharing rules, terminal supervision and exception review all matter because the event itself is a security-relevant assertion about who was present. Where the environment supports it, attendance verification should be tied more tightly to the individual than to a reusable credential or unattended endpoint.
Risk and Threat Considerations
Proxy punching creates a direct integrity risk because the attendance record can be falsified without obvious system errors. It also creates an abuse path for insiders, since the most common failure mode is not a sophisticated bypass but ordinary credential sharing, badge lending, or unattended access.
Failure mechanism: The control accepts possession of a badge, password, or open terminal as sufficient proof of the employee’s presence, so a proxy can generate a legitimate-looking attendance event.
Impact: The organisation may pay for hours not worked, lose trust in attendance records, and miss related misconduct because the fraud blends into normal workflow activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Proxy punching exploits weak proof of who is using the attendance system. |
| IA-5 — Authenticator Management | Shared badges, passwords, and borrowed credentials are the usual abuse path. | |
| AU-6 — Audit Record Review, Analysis, and Reporting | Attendance fraud is often detected through review of suspicious clock-in patterns. | |
| Recommendation — Require stronger user authentication at clock-in and prevent credential sharing. Manage authenticators so they are unique, accountable, and not shared. Review attendance logs for repeated, anomalous, or proxy-like usage patterns. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | Proxy punching is enabled by weak access control at the attendance point. |
| Recommendation — Apply access-control rules that bind attendance actions to the correct person. | ||
| CIS Controls v8 | CIS-5 — Account Management | The abuse depends on people using shared or poorly governed credentials. |
| Recommendation — Ensure each worker has a unique accountable access path for attendance events. | ||
Practitioner Guidance
What to watch for: Repeated clock-ins from the same terminal for different employees, unusual attendance timing patterns, and cases where the same badge or account appears to be used in ways that do not match the worker’s physical routine are all signals worth reviewing. The best control question is not just whether the system logs attendance, but whether it can prove the right person was there when the event occurred.
Practitioner takeaway: If attendance can be recorded by convenience alone, proxy punching will eventually appear; the practical defense is to raise the cost of impersonation and make exceptions visible.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org