Is Time Theft a Crime? a Plain-English Guide for Employers

In the U.S., time theft is not a standalone federal crime and is usually handled as civil employee misconduct, but it can become a criminal theft or fraud charge when intent and dollar value cross the line. In Illinois, theft of labor or services can become a Class 4 felony when the value exceeds $500, with 1–3 years in prison and fines of up to $25,000. (ADP's legal overview)

A server clocks in before opening, disappears during prep, then claims every minute on the timecard. A cook asks a friend to punch in after calling out. A manager notices the pattern only after payroll closes, when the dollars have already left the business. That's the point where a practical question becomes urgent: is time theft a crime, or is it an HR problem?

For most operators, the answer starts with documentation, not police involvement. You need to separate a sloppy punch from deliberate deception, calculate the actual loss, and investigate without creating unpaid-work liability of your own.

Table of Contents

• What Time Theft Actually Means on the Clock
• The Short Answer to Whether It Is a Crime
• How Intent and Dollar Value Change the Legal Picture
  • What proves deliberate conduct
  • How the loss changes the track
• What Happens When the Case Crosses the Line
• How to Investigate Without Creating Wage-Theft Liability
  • Pull the actual record first
  • Give the employee a fair chance to explain
  • Pay every hour actually worked
• Practical Steps to Prevent Time Theft on Shift-Based Teams
  • Close the punch loopholes
  • Reconcile work systems
  • Fix the scheduling conditions
• Quick Checklist and Final Word for Operators

What Time Theft Actually Means on the Clock

From a manager's chair, time theft means an employee receives pay for hours they didn't work. Wage theft is the reverse: the employer fails to pay for hours the employee did work. Confusing the two creates bad investigations and can expose an operator to a separate wage claim.

The recurring examples are familiar in restaurants and other shift-based businesses:

• Buddy punching: One employee clocks in or out for another employee.
• Re-recorded off-the-clock work: An employee works without recording the time, then alters or re-enters the record to create a misleading timeline.
• Inflated breaks: The timecard shows a shorter or properly recorded break while the employee remains away from the station longer.
• Early clock-ins: An employee clocks in before setup is authorized, then doesn't perform work during the entire recorded period.
• Late clock-outs: A worker stays on the clock after closing tasks are finished and personal activity begins.
• Personal errands: The employee handles non-work activities while claiming paid time.
• Remote-work gaps: A laptop remains connected while the employee is unavailable and performs no assigned work.

The control problem is rarely just the time clock. Scheduling rules, manager approvals, shift coverage, and payroll corrections all affect whether a questionable entry can be verified. Your written employee policies for restaurants should define clocking rules, corrections, breaks, off-the-clock work, and buddy punching in language staff can understand.

Not every discrepancy is theft. Minor rounding errors may result from ordinary clock behavior. Union-protected wash time may be governed by a collective bargaining agreement. Meal-period auto-deductions can also produce inaccurate records when payroll applies them automatically and the employee worked.

The legal weight comes from intent, not merely from a mismatch between a schedule and a punch. A single correction may reflect confusion. A repeated false record, coordinated punch arrangement, or deliberate effort to hide non-work points in a different direction.

The Short Answer to Whether It Is a Crime

In the U.S., time theft usually isn't a standalone federal crime. It's normally handled as employee misconduct through coaching, discipline, termination, or a civil recovery process. Multiple legal summaries describe the conduct as falling outside a specific federal time-theft statute, while broader theft, fraud, or services laws may apply when the facts support them. (Forbes Advisor's employer guide)

Most states don't have a statute titled “time theft.” If prosecutors pursue a case, they generally use an existing law that covers theft of services, fraud, falsified records, identity misuse, or unauthorized system access. The issue extends beyond whether someone was paid for time they didn't work. It's whether the employer can prove a deliberate scheme, a measurable loss, and conduct that fits the wording of a local criminal statute.

A useful operating rule is to examine three factors:

1. Dollar value: How much did the alleged conduct cost after the records are reconciled?
2. Intent evidence: Does the file show deception, repetition, coordination, or falsification?
3. Misuse beyond payroll: Did the conduct involve another person's credentials, a badge, a computer system, or an identity?

Misdemeanor thresholds commonly begin around $500 to $1,000, but the applicable rule depends on the state and the statute. Lower-value, one-off padding usually stays in the civil or employment bucket. Even then, an employer may still terminate the employee, seek restitution, or challenge unemployment eligibility where state rules permit.

Factor	Civil Path	Criminal Path
Amount	Isolated or relatively small payroll loss	Amount reaches a state theft or fraud threshold
Intent	Confusion, error, or weak evidence of purpose	Repeated deception, fabricated records, or coordinated conduct
Evidence	Timecard review and employee explanation	Reliable records showing a deliberate and quantifiable scheme
Employer response	Correction, discipline, termination, or civil recovery	Legal counsel and possible law-enforcement referral
Main risk	Wrongful discipline or unpaid wages	Theft, fraud, services, identity, or computer-misuse exposure

Don't call the police because a timecard looks strange. Build a file first. A criminal referral without clean records can damage the business, undermine employee trust, and make a routine payroll dispute look reckless.

How Intent and Dollar Value Change the Legal Picture

Two dials move a case from the HR office toward a prosecutor's desk: intent evidence and aggregate dollar value. Neither dial works alone. A high dollar amount supported by weak records may remain difficult to prove, while a clear deception pattern can create serious exposure even before the loss becomes large.

What proves deliberate conduct

Document observable behavior, not conclusions. A manager's note should say that an employee's badge was used while the employee was absent, not that the employee “stole time.”

Useful signals include:

• Ignored warnings: The employee receives a clear explanation of the rule, acknowledges it, and repeats the behavior.
• Fabricated records: The employee changes logs, submits false corrections, or creates a timeline that conflicts with system data.
• Forged approvals: A signature, manager authorization, or written explanation appears falsified.
• Credential misuse: A stolen or shared badge is used to create a punch.
• Remote-access manipulation: System activity suggests the employee maintained a connection while intentionally avoiding assigned work.
• Coordinated buddy punching: Multiple employees arrange punches or provide matching explanations.

The stronger the pattern, the easier it is to argue that the conduct was intentional rather than accidental. Expert guidance similarly emphasizes repeated falsification, buddy punching, and deliberate non-work while on the clock as facts that help establish intent and quantifiable loss. (TCP Software's evidence guidance)

How the loss changes the track

State theft laws often use value tiers, but there is no national schedule that applies everywhere. Some independent summaries cite thresholds ranging from a few hundred dollars to about $2,500, which is why you must check the law where the business operates. (SoliNK's time-theft analysis)

Aggregate Value	Typical Classification	Realistic Employer Response
Under $500	Often an infraction or low-level misdemeanor, depending on jurisdiction	Preserve records, investigate, correct payroll, and apply discipline
$500 to $1,000	Commonly a misdemeanor range, although state rules differ	Consult HR or counsel and assess whether the evidence supports restitution or referral
$1,000 to $5,000	May move into a gross misdemeanor or felony track in some jurisdictions	Secure the evidence, calculate the loss, and obtain state-specific legal advice
Over $5,000	Routinely treated as felony-level exposure in many state schemes	Involve counsel before referral and protect the chain of records

Those bands are operating reference points, not a substitute for local law. The Illinois example is more specific: when theft of labor or services exceeds $500, the offense may be a Class 4 felony, carrying 1–3 years in prison and up to $25,000 in fines; lower-value cases remain misdemeanors with up to 364 days in jail. (ADP's Illinois discussion)

Aggravating facts can also change the response. A fiduciary-style role, remote-work fraud, hours billed to a healthcare or government program, or conduct involving computer-misuse or identity laws deserves faster legal review.

Practical rule: Track the pattern, total the loss, and then choose the response. Don't choose the response first and search for evidence afterward.

What Happens When the Case Crosses the Line

A restaurant case rarely begins with a detective at the back door. It begins with a shift lead noticing that an employee who called out somehow has a completed punch.

On the first incident, the manager checks the schedule, time clock, and staffing notes. The employee says a coworker was trying to help. The manager explains that nobody may clock in for another person and records the conversation, including the employee's response. If the evidence shows an isolated mistake, verbal counseling may be enough.

The second incident changes the file. The same two employees appear connected to conflicting punches, the entries don't match the floor coverage, and the earlier rule was acknowledged. The manager brings HR into a formal meeting, provides the records, takes a written employee statement, and issues a final written warning if policy and applicable employment rules support it.

A third incident may show a sustained scheme rather than a bad punch. Suppose the restaurant can connect repeated buddy punching to falsified records, calculate the resulting payroll loss, and show that the conduct reaches a state theft-by-deception threshold. At that point, termination will usually come before police involvement. The operator should preserve the original records, stop informal access, and consult counsel about whether a referral is appropriate.

Low-dollar cases rarely attract prosecutorial attention unless the employee held a position involving trust, cash, records, or access to sensitive systems. A restaurant still has every right to protect its payroll, but a referral should be based on a complete evidentiary file, not anger over a single shift.

For a large or technically complicated matter, a remote forensic accountant hiring resource can help identify a defensible method for reconciling records and calculating loss. That doesn't replace employment counsel or local criminal-law advice. It can help the operator avoid presenting an inflated number based on assumptions.

Union contracts may require specific investigation and discipline steps. At-will policies may allow a shorter process, but they don't erase wage laws, anti-retaliation rules, or contractual obligations.

How to Investigate Without Creating Wage-Theft Liability

The fastest way to turn a time-theft investigation into a business problem is to withhold pay while you investigate. Employers should not refuse payment for suspected time theft, because refusing to pay for time worked can violate wage-and-hour law. (Shiftbase's wage-compliance guidance)

Use this order: investigate, pay, then discipline.

Pull the actual record first

Start with system data, not a manager's impression. Export the original clock-in and clock-out records, schedules, approved edits, POS activity, badge access, relevant video, and written coverage notes. Keep the original files unchanged and create a separate working copy for analysis.

Compare scheduled hours with punched hours, then compare both against evidence of work. In a restaurant, POS transactions, opening tasks, cash-drawer activity, delivery records, and station coverage can help explain whether a person was working. They don't prove the entire case by themselves, but they can identify discrepancies worth discussing.

Use the same review process for every employee in a comparable situation. Selective enforcement creates credibility problems and can make a legitimate policy look like a pretext.

Give the employee a fair chance to explain

Prepare a discrepancy log with the date, scheduled shift, recorded punch, observed conflict, source of the conflict, and estimated payroll effect. Ask neutral questions. The goal is to find out whether the entry reflects a forgotten punch, an approved correction, an auto-deduction problem, off-the-clock work, or intentional padding.

A corrective-action file should include:

• Employee statement: Record the explanation in the employee's own words and invite corrections.
• Witness list: Identify who observed the shift, punch, absence, or correction.
• Supporting records: Preserve schedules, system exports, video references, and manager notes.
• Acknowledgment: Ask the employee to sign that the discussion occurred, not necessarily that they agree with every conclusion.

Pay every hour actually worked

If the investigation discovers unapproved overtime or work performed before or after the recorded shift, correct payroll under applicable law. Don't erase a payable hour because the employee violated a scheduling rule. Discipline the rule violation separately.

Managers also need to stop allowing “just finish closing” work after clock-out. If the business benefits from the work or knows it is happening, the employee may later claim those minutes as compensable time. Your overtime tracking process should make missed punches and corrections visible before payroll approval.

The safe sequence is simple: Pay for work performed, document the misconduct, and enforce the policy through discipline rather than an improvised wage deduction.

Practical Steps to Prevent Time Theft on Shift-Based Teams

Prevention works when the clock, schedule, manager approval, and payroll export tell the same story. A policy alone won't stop buddy punching if employees can freely share credentials or managers approve corrections without reviewing the shift.

Close the punch loopholes

Use biometric or PIN-based clock-ins where lawful and appropriate. A personal PIN reduces casual sharing, while a biometric system can help prevent one worker from clocking in for another. Review local privacy, disability, labor, and collective bargaining requirements before deploying biometric tools.

For mobile or distributed work, use geofenced punches tied to the store's permitted location or Wi-Fi. Treat location data as a verification signal, not an automatic finding of dishonesty. A worker may have a legitimate reason for a location mismatch, and a false positive still requires review.

Automated break alerts can prompt a supervisor to confirm whether a break occurred, whether the employee worked through it, or whether payroll applied an auto-deduction incorrectly. The alert should start a conversation, not trigger an automatic deduction.

Reconcile work systems

Run POS-to-time-clock checks that compare cash-drawer opening times, transaction activity, and scheduled shifts. A mismatch may flag a genuine problem, but it may also reflect a manager opening the drawer, a shared station, or a system delay.

Separate time-and-attendance approval from the manager accused of changing or approving the record. Rotate punch-review duties where practical, lock payroll exports after each pay period, and retain an audit trail for every correction.

Operators looking for broader employee-theft controls can review advice from Overton Security alongside their payroll and employment-law guidance. Security controls work best when they support a documented process rather than replace one.

Fix the scheduling conditions

Unfair scheduling can make timekeeping conflict worse. Last-minute shift drops, repeated clopenings, and unreliable coverage create resentment and encourage employees to treat rules as optional. Build schedules from actual availability, publish changes clearly, and require approved shift swaps instead of informal substitutions.

A structured staff scheduling workflow helps managers keep the schedule, coverage changes, and timecard review connected. AnchOps offers scheduling, shift coverage, reliability tracking, time clocks, POS-synced timecards, batch approval, and payroll export for shift-based teams. It can be used alongside other controls, with managers still responsible for reviewing exceptions.

Finish with a written policy signed at hire. Define buddy punching, early and late punches, breaks, off-the-clock work, corrections, and consequences. Refresh the training annually and whenever the timekeeping process changes, so an employee can't reasonably claim the rule was unknown.

Quick Checklist and Final Word for Operators

Run this checklist this week, not after the next payroll dispute:

• Document suspicious patterns: Save the original punches, schedules, corrections, and manager observations as soon as a pattern appears.
• Run a controlled audit: Compare time records with POS activity, coverage, access logs, and available video. Review comparable employees consistently.
• Escalate by threshold: Total the alleged loss and assess intent before choosing HR discipline, legal advice, restitution, or a criminal referral.
• Install punch verification: Use personal credentials, lawful location checks, break alerts, and exception reviews to reduce preventable gaps.
• Separate buddy punching from corrections: A forgotten punch, payroll auto-deduction, and approved schedule change aren't automatically theft.
• Review wage rules before deductions: Don't claw back wages informally. Check state-specific requirements and pay for all hours worked.
• Close policy gaps: Put the rules in the handbook, obtain acknowledgment, and train supervisors on the same process.

Two mistakes cause most operator headaches. The first is clawing back wages from a paycheck because a manager believes an employee stole time. The second is treating every discrepancy as proof of theft, even when the true cause is rounding, a meal-period setting, a system error, or unrecorded work.

Aggressive prevention is defensible only when it respects minimum-wage, off-the-clock, and final-paycheck rules. A manager who punishes false punches but ignores unpaid closing work has created a second risk instead of solving the first.

Clean timekeeping data is your strongest defense on both sides. It helps you identify deliberate time theft, and it helps prove that your own payroll process paid people for the work they performed.

---

If your shift team needs fewer punch gaps and cleaner scheduling records, visit AnchOps to review its scheduling, coverage, time-clock, timecard approval, and payroll-export tools. Set up a controlled timekeeping review this week, then use the resulting exceptions to tighten your policies and manager workflow.