How to stop fake security patrols: NFC, QR and GPS

The tour log said 100%. The camera said otherwise.

Every security firm owner knows the call. The client pulled camera footage after a break-in, and the guard who logged every checkpoint on time was in a parked car for most of the night. The contract is now at risk, and so is every other report you have sent that client.

Faking rounds is as old as patrols. With mechanical watchclocks, guards copied station keys or tampered with the clock. The industry even has a name for filling in checks that were never done: pencil whipping. Smartphones didn’t end it. They changed how it is done, and they made it possible to catch.

How patrol logs get faked

You don’t need a manual for cheating, but you do need to know the patterns, because each one is caught by a different check.

Scanning from the wrong place. A photo of a QR code, or a copy of a tag, scanned away from the checkpoint. The scan looks valid; the location doesn’t.
Moving the checkpoint. Tags removed from walls and carried around, or replaced by copies. Basic NFC tags can be copied with inexpensive readers.
Batching. Every checkpoint scanned in a few minutes, then nothing for hours. The count is right; the timing is impossible.
Going dark. Location turned off on the phone after clock-in, or a device that “lost signal” for the whole night.
Logging on paper after the fact. A neat paper log written at the end of the shift, with round numbers and no exceptions.

NFC, QR and GPS checkpoints compared

Each method proves something different. Most sites need a mix: NFC or QR where you must prove a guard stood at a specific door, GPS where the point is to cover an area.

What each checkpoint type proves
Method	What a scan proves	Weak points	Best for
NFC tag	The phone touched that tag, within a few centimetres.	Basic tags can be copied or removed. Phones need NFC. Some metal surfaces block reads.	Doors, roof access, fire panels, anywhere indoors you must prove presence.
QR code	The phone’s camera saw that code.	Can be photographed and scanned elsewhere. Fades and peels outdoors.	Low-risk indoor points; quick, cheap rollouts.
GPS geofence	The phone reported a position inside an area.	Accuracy of several metres outdoors and poor indoors. Can’t prove a specific room.	Parking lots, perimeters, mobile patrol stops, construction sites.
Secure NFC tag	The phone touched that exact physical tag; each tap produces a new signed code.	Costs more per tag, and the system has to support it.	High-risk sites where copied tags are a real concern.

The weakness is not the tag Any checkpoint can be defeated if the only check happens on the phone. What makes a scan trustworthy is what happens after it is sent: whether a server checks it against the checkpoint, the place and the time.

What server-side checks catch

When you evaluate a patrol system, ask what it checks once a scan reaches the server. A good system checks at least these:

1The credential matches the checkpoint and the site. A tag from another site, or an unknown code, is rejected.
2The location matches the checkpoint. The phone’s position at the moment of the scan is compared with the checkpoint’s coordinates. A scan 300 m away is flagged as out of range, which catches photographed and copied codes.
3The time fits the shift and the round. Scans outside the guard’s shift or the round’s window don’t count.
4The timing is physically possible. Ten checkpoints spread across a campus can’t be scanned in two minutes. Know the realistic walking time between points and look for rounds that beat it.
5The request is genuine. A scan replayed or modified on its way to the server must be refused, not counted twice.
6Missing data is visible. A scan with no location, or a phone with location turned off, should show as unverified, not as a clean pass.

Design rounds that deter crime, not just collect scans

Guards complain, with reason, that some sites turn them into tag scanners: dozens of checkpoints so close together that a round becomes a race from one sticker to the next, eyes on the phone, while the gate that matters goes unchecked. More checkpoints don’t mean better security.

Use the fewest checkpoints that cover the real risks, and make each one ask for something.

Put checkpoints where the risk is: exterior doors, roof hatches, loading docks, fire panels, parking levels, fence lines.
Attach a task to each one: “Gate chained?” “Panel normal?” A yes or no, with a photo when the answer is no.
Use time windows, not exact minutes, so rounds are less predictable to anyone watching the site.
Spot-check in person, and compare tour logs with camera or access-control logs once a month.

Personal phones or site phones?

Guards resist apps on their personal phones for two reasons: battery, and the fear of being tracked off duty. Both are fair, and both are solvable. An app that reads location only at the moments that need proof, clock-in, checkpoint scans and reports, uses far less battery than one that tracks continuously, and it never records anything outside the shift.

Tell guards plainly what is collected, when, and who can see it. Canadian privacy law, including PIPEDA and Québec’s Law 25, expects employers to be open about this, and guards who understand it are more likely to use the app properly.

Site phones avoid the personal-device question but add charging, loss and sharing problems. If you use them, assign each device to a site, keep it on a charger at the post, and make guards sign in with their own account so every scan is tied to a person.

Catch a missed round in minutes, not at month-end

A missed checkpoint you discover in a monthly report is a story for the client. One you see at 2:15 a.m. is a phone call to the guard and a note in the report. Set up alerts for a late round and a missed checkpoint, decide who receives them at night, and decide what they do: call the guard, then the supervisor, then dispatch a mobile patrol.

Record the reason for every miss. Clients accept “checkpoint 4 missed while escorting a trespasser off site” far more readily than a perfect log every night.

A checkpoint audit you can run this week

Print this, walk the site with it in daylight, and fix what fails before the next night shift.

Checkpoint audit worksheet

CHECKPOINT AUDIT · Site: ______________   Date: ________   By: ________

TAGS AND PLACEMENT
[ ] Every checkpoint is at something that must be checked
    (door, gate, roof access, loading dock, fire panel, parking level)
[ ] No two checkpoints are close enough to scan without walking
[ ] Tags are fixed so they can't be peeled off without damage
[ ] Each tag scanned today with a test device, and it registered
[ ] Tag positions match the coordinates in the system (within ~20 m)

TOUR DESIGN
[ ] Number of checkpoints per round: ____ (aim for the fewest that cover the risks)
[ ] Each checkpoint has a task or question ("Gate chained? Y/N, photo if not")
[ ] Rounds have a time window, not an exact minute
[ ] Minimum realistic walking time between checkpoints noted: ____ min

ALERTS
[ ] A missed checkpoint alerts: __________ (name) within ____ min
[ ] A late round alerts: __________ within ____ min
[ ] Scans that fail location or credential checks are flagged, not silently accepted
[ ] Someone reviews flagged scans every morning: __________

SPOT CHECKS
[ ] Supervisor visited unannounced this month on: ________
[ ] Tour log compared with CCTV or access-control logs on: ________

How GuardDesk verifies patrols

GuardDesk supports NFC, QR and GPS checkpoints in one round. Every scan is checked again on the server against the checkpoint’s credential and coordinates; the distance is recorded, and a scan made too far away is marked out of range instead of verified. Modified or replayed requests are refused.

A missed checkpoint, a scan that fails verification, or an incomplete or missed tour becomes an exception in the supervisor’s live inbox, and the client’s daily report shows verified, late and missed checkpoints honestly. The guard app reads location only during the shift, at the moments it is needed.

Questions owners ask

Can security guards clone NFC checkpoint tags?

Basic NFC tags store a fixed identifier that can be copied with inexpensive readers. Secure tags that produce a new signed code on every tap can’t be usefully copied. In either case, a server that compares the scan’s location with the checkpoint’s position catches a copy scanned somewhere else.

Are NFC tags better than QR codes for security patrols?

NFC proves the phone was within a few centimetres of the tag and survives weather better; QR codes are cheaper and work on any phone but can be photographed. Either is reliable when the system also checks location and timing on the server.

How do you stop guards from scanning photos of QR codes?

Record the phone’s location with every scan and have the server compare it with the checkpoint’s coordinates. A photographed code scanned from the guard room or a car shows up as out of range. Switching high-risk points to NFC adds another layer.

Can a guard turn off GPS on a patrol app?

Yes, phone settings let anyone turn location off. A well-designed system doesn’t hide it: scans without a location are marked unverified, and supervisors are alerted, so turning location off becomes visible instead of convenient.

How many checkpoints should a one-hour patrol have?

As few as it takes to cover the real risks on the site, each with a task attached. On many mid-size commercial sites that is well under a dozen per round. Dozens of closely spaced tags tend to produce scanning, not patrolling.

Sources

General information for security firm owners and managers. Checked October 14, 2026.

How to stop fake security patrols: NFC, QR and GPS compared