1. Punch at one fixed kiosk
A clock-in that can happen from any phone is a clock-in anyone can do for anyone. Put a dedicated tablet kiosk where staff arrive, and make it the only place punches happen.
2. Accept punches only from your own network
Restrict the kiosk to the location's internet address, so a remembered link does not work from a car park or a living room. In PunchMan this is Settings → Kiosk lock-down.
3. Make the punch prove who is there
A PIN proves someone knows a number; it does not prove who they are. A fingerprint scanner or a face check ties the punch to the person. Get written consent first, because biometric data is regulated in many places, and keep the PIN as a fallback.
4. Lock out guessing and shared PINs
Use personal PINs, never a shared code, and lock an employee number after repeated wrong PINs. PunchMan locks a number for five minutes after five wrong PINs.
5. Have employees confirm their own hours
When employees review and sign their own timecard each pay period, a punch they did not make is spotted by the person it affects. PunchMan prints timesheets with signature lines and lets employees confirm their timecard at the kiosk.
6. Review exceptions every pay period
Look at the unusual shifts: back-to-back punches for friends, face mismatches, punches outside scheduled hours, and missing punch-outs. Fix what is wrong in Timesheets and let the activity log record why, so every correction can be explained at payroll time.
Most of all, say clearly that time records are checked. A visible check stops more buddy punching than any punishment.