A 200-person warehouse, four pay frauds, no audit trail
A 3PL operations manager in the East Midlands runs a 200-person warehouse. About 60 of those workers are agency, billed weekly. Last quarter the finance team queried an invoice — 184 hours for a picker the shift supervisor did not remember being on site that week. The agency stood by the timesheet. The 3PL had nothing to argue with. They paid.
That line item is one of four fraud patterns running quietly through UK warehouse payroll. None are dramatic. None get reported to Action Fraud. They are the friction cost of paying shift workers across permanent, agency and casual hours on paper or fixed-terminal swipe cards designed in 1995.
UK logistics employs 2.5 million people (Logistics UK), and 872,000 temporary or contract workers are on assignment any given day (REC, Recruitment Industry Status Report 2024/25). Warehouse and distribution is one of the largest sectors absorbing those temps. The arithmetic of timesheet fraud applies to all of them.
This guide names the three patterns that actually happen, shows what a paper or swipe-card system cannot catch, explains how GPS geofence clock-in changes the failure modes, and runs the maths for a 200-person operation.
The three fraud patterns
1. Buddy-punching
One worker swipes the card or taps the app for a mate who is still on the M1. The hour gets paid. The mate splits the difference at the end of the week. It is low-impact per event — typically a few minutes per shift — but persistent. The American Payroll Association estimates buddy-punching costs employers up to 2.2% of gross payroll in higher-risk sectors (Hubstaff summary of APA data). UK shift-work behaviour is identical. On a £2.4m warehouse wage bill, 2.2% is £52,800 a year.
2. Ghost-worker agency invoicing
The agency invoices for hours worked by someone who never showed — sometimes a fabricated name, more often a real worker who has stopped attending but whose timesheet keeps getting signed off. Discovery is late and accidental: finance spots a name HR does not recognise, or the supervisor finally notices an empty pick station. Cifas recorded 64% of all National Fraud Database filings as identity fraud in 2023 and over 409,000 instances of fraudulent conduct in 2022 (Cifas Reports & Trends). The ONS Crime Survey estimated 3.2 million fraud incidents in the year ending March 2024, with police-recorded fraud up 7% to 1.2 million offences (ONS).
3. Clocked-but-departed
The worker taps in, walks the floor for ten minutes, drives home, returns near shift end and taps out. Modern systems built around a single clock-in event at the door are blind to this. So are paper timesheets and fixed-terminal swipe cards. The only systems that catch it are ones that timestamp and geo-stamp both ends of the shift.
A fourth pattern — fake payslips used for tenancy or credit applications — is downstream of the same problem: an employer that cannot produce a tamper-evident, source-of-truth payslip cannot dispute a forged one. Cifas data on identity fraud filings shows fake documentation is one of the routes in.
What a paper or swipe-card timesheet cannot catch
A signed paper timesheet is evidence of who signed it, not who worked. ACAS is explicit: employers must keep records adequate to demonstrate the 48-hour weekly maximum, night-work limits and young-worker restrictions, and these records become the factual foundation if a worker brings a tribunal claim (ACAS, Working time rules). Retention is two years. The tribunal claim window for an unauthorised deduction is three months (gov.uk, Employment tribunals). A paper timesheet with a supervisor's initial against a fabricated row is worth roughly the paper it is printed on.
Fixed-terminal swipe cards prove a card was tapped, not who tapped it. Buddy-punching is the structural failure of the swipe-card model. Camera-only systems theoretically catch it, but only if someone reviews the footage — in a 200-person warehouse on three shifts, nobody does.
HMRC's Real Time Information regime adds the regulatory floor. Employers must submit a Full Payment Submission on or before each payday with pay and deductions, and corrected FPS as soon as errors are spotted (gov.uk, Reporting to HMRC). Payslips must arrive on or before payday and show earnings, deductions and hours where pay varies by time (gov.uk, Payslips). When the input — the timesheet — is unreliable, every RTI submission inherits the error.
How GPS geofence clock-in changes the failure modes
GPS geofence clock-in captures a location fix at two moments only: clock-in and clock-out. Nothing in between. The phone records latitude, longitude and accuracy radius at the moment the worker taps the button; the server records its own timestamp; the geofence around each site decides whether the punch sits inside the boundary or outside it. This is explained at length in our GPS geofence clock-in technical and legal guide.
Three things change.
Buddy-punching becomes obvious. The same device cannot clock in two workers within five minutes from the same coordinates without a flag. The control is structural, not behavioural — the supervisor does not have to spot it; the system does.
Ghost workers fail at reconciliation. When the agency invoice lands, the operator can cross-check it against the GPS-validated shift log. A name with no geo-stamped clock-in events is the entire dispute, presented in one column. The cost of the dispute shifts from the operator to the agency, and the late-discovery problem disappears because the cross-check happens weekly, not quarterly.
Clocked-but-departed leaves a fingerprint. The clock-out fix at a coordinate two hundred metres outside the geofence, or at a time that does not match the supervisor's last sighting, becomes a flag rather than a clean punch. The supervisor has the evidence to have the conversation.
The model is flag, not block. An honest worker who clocks in just outside the radius because GPS has bounced off a steel-clad warehouse roof should not be denied pay; they should generate a supervisor notification. Vendors that ship continuous tracking by default — a moving dot on a map all shift — solve a problem that does not exist and create three that do.
The UK GDPR side — proportionality is the test
Location data captured at clock-in is personal data under UK GDPR. The ICO's final guidance on monitoring workers, published 3 October 2023, sets out what operators must do.
Four requirements apply.
Pick a lawful basis under Article 6 — legitimate interest is the standard route for punch-only time recording, and the balancing test passes easily when the alternative is continuous tracking. Carry out a DPIA before rollout; the ICO treats workplace monitoring as Article 35 high-risk processing. Tell workers in plain language what is collected, why, how long it is kept, and how they can object. Stay proportionate: two GPS fixes per shift is the minimum necessary to achieve the payroll-integrity purpose, and anything more fails the proportionality test.
The compliance breakdown — Article 6 selection, DPIA template, transparency notice — is laid out in our GPS geofence clock-in legal guide. GPS is not a free pass to monitor a workforce. It is a narrow control with a narrow lawful basis.
The 200-person warehouse — worked example
Hold the assumptions transparent so the maths can be rebuilt against your own roster.
- 200 workers, 140 permanent and 60 agency.
- Blended hourly rate £12.
- 200 working days a year, 8-hour shifts.
- Annual gross payroll £3.84 million.
Buddy-punching at 2% of gross payroll (a conservative read of the APA's 2.2% ceiling, applied only to the time recording, not the full wage bill): £76,800 a year. The APA figure is US data; the underlying behaviour is sector-driven, not country-driven, and UK shift operators report similar friction.
Ghost-worker agency invoicing at 0.5% of the agency-billed total (60 workers, 1,920 hours each, £12 blended rate, £25 agency rate = £2.88m annual agency spend; 0.5% is two workers' worth across a year): £14,400 a year.
Clocked-but-departed at 30 minutes a shift, three times per worker per quarter, across 50 workers: 50 × 12 events × 0.5 hours × £12 = £3,600 a year. Small per event, persistent across the roster.
Combined exposure: ~£94,800 a year on a £3.84m wage bill. The honest range, given uncertainty in each input, is £30,000 to £100,000. The 60-worker agency component is the largest single line, which matters because it is also the easiest to recover at the invoice reconciliation stage.
Against a WagePerks all-in price of £4.50 per employee per month, the platform cost for 200 workers is £10,800 a year. Even at the low end of the savings range — £30,000 — the payback is under five months.
The agency-side wins
For a 3PL that takes agency invoices from one or more suppliers, GPS-supported logs change the reconciliation conversation. A weekly export of geo-stamped clock-in and clock-out events, by worker, is the artefact a finance team needs to query an invoice line. REC's 2024/25 industry report found 35% of recruitment firms reported bad debt issues in the past year (REC Status Report 2024/25) — disputed invoices sit inside that figure. A GPS log does not stop the dispute, but it shifts it from a he-said-she-said into a documented one, and the cycle time collapses.
Recruitment agencies running their own GPS clock-in get the same benefit on the other side of the desk. The mechanics are covered in our recruitment-agency GPS clock-in guide.
What WagePerks does
GPS geofence clock-in is part of the eleven-module WagePerks base, included at the £4.50 per-employee-per-month all-in price. Two GPS fixes per shift, ICO-proportional by design, DPIA template included for the employer. The payslips module surfaces actual hours worked against the GPS-validated shift log, so the payslip and the timesheet match line for line. The clock-in / clock-out feature handles offline punches in steel-clad warehouses and reverse-geocodes the location for the audit trail.
White-label is included. Rolling monthly. No GPS add-on tier and no time-and-attendance upcharge. Full feature parity in any modern browser; native iOS and Android apps launching Q3 2026.
For the UK logistics industry view including warehouse-specific rota and shift handling, see the industry page.
Sources
All sources verified 2026-06-11. We re-verify quarterly.
- Logistics UK — Skills and employment hub — 2.5 million people in UK logistics
- REC — UK Recruitment Industry Status Report 2024/25 — 872,000 temps daily, £40.6bn GVA, 35% bad debt
- ONS — Crime in England and Wales, year ending March 2024 — 3.2m fraud incidents, +7% police-recorded
- Cifas — Reports & Trends — 64% identity fraud filings 2023, 409,000+ instances
- Hubstaff summary of American Payroll Association — buddy-punching up to 2.2% of payroll
- ICO — Monitoring workers guidance, October 2023 — lawful basis, DPIA, proportionality
- ACAS — Working time rules — record-keeping, 2-year retention, tribunal evidence
- gov.uk — Running payroll: reporting to HMRC — FPS on or before payday, RTI corrections
- gov.uk — Payslips — mandatory contents and timing
- gov.uk — Employment tribunals — 3-month unauthorised-deduction claim window
Where to next
- See the GPS clock-in / clock-out feature page for the technical specification, offline handling and geofence radius rules.
- Read the payslip feature page for the line-by-line audit trail between timesheet and pay.
- Compare the eleven-module base on the pricing page and book a 30-minute walkthrough.