Patrol Verification · Fake Scans
Can a Guard Fake a QR Checkpoint Scan? How Photographed QR Codes Get Caught
The Oldest Trick in Patrol Software
On the first night at a new post, an officer walks the route once and photographs every checkpoint tag. From then on, the round can be "completed" from the break room: open the photo, point the patrol app at the screen, scan, swipe to the next photo, scan again. The log shows a perfect round. Nobody walked it.
This is not a theoretical attack. It is the QR version of the RFID tag pulled off the wall and kept in a drawer, which is why we have written before that older checkpoint systems record events, not reality. When I commanded police units, the only way to know an officer had really been at a post at 3 a.m. was to go and check in person. Most security companies still rely on a version of that, or on trust.
Why Most QR Systems Accept a Photo
A QR code is just encoded text. When an app scans it, it decodes the string and compares it to the expected checkpoint ID. If the string matches, the scan counts.
The decoder does not care whether the pattern came from a laminated tag on a loading dock door or from an image on a second phone. To a standard QR reader, both are identical. That is the whole problem: the scan proves that someone had the code, not that someone was at the checkpoint.
Three Ways Systems Try to Stop It
| Method | What it catches | Where it falls short |
|---|---|---|
| GPS radius check | Scans made far from the site | A break room 40 yards away is often inside the radius; indoor GPS drifts |
| Rotating or dynamic codes | Reused photos of an old code | Needs a powered screen or device at every checkpoint, which brings back hardware cost |
| Image validation on the server | Photos of screens and printouts, and repeated images | Needs a data connection during the round |
Each method has a cost. GPS alone is cheap but coarse. Rotating codes are strong but turn a sticker into an electronic device. Image validation keeps the sticker and moves the intelligence to the server.
How Trinity Guard® Checks the Scan Itself
Trinity Guard® does not stop at decoding the string. Every QR scan is sent to the server and validated in real time, and an AI model looks at the scan itself for the signs of a photographed code: a screen, a printout, or an image that has already been used. The model was trained by our engineering partner on a large set of scan images, as described in Petadev's case study of Trinity Guard®.
Two design choices matter here.
The model judges an image, not a person. When a scan looks irregular, it is flagged and surfaced for inspection. It is not an automatic write-up. A supervisor opens the record, looks at the timeline and the officer's other activity, and decides. We explain why that separation matters in our article on AI guard scoring and state AI laws.
Validation is online, so QR rounds need a connection. A server cannot check a scan it never receives. For a QR-based round, the phone needs a data connection for the whole round. Where coverage is weak, such as a large outdoor yard or a construction perimeter, GPS-based patrols are the better fit: they record without coverage and sync when the phone reconnects. We cover that trade-off in offline guard tour systems.
What a Flag Means, and What It Doesn't
A flagged scan is a question, not an answer. A glare on a dirty tag, a cracked phone camera, or a checkpoint mounted behind glass can all produce a scan that looks unusual. That is why the system flags and the human judges.
What a flag does reliably is remove the easy option. Once officers know that a photo of a code will be noticed, the break-room round stops being worth the risk. In practice, the strongest effect of photo detection is the scans that never get faked.
Five Signs Your Patrol Data Is Being Gamed
- Perfect intervals. Checkpoints scanned exactly the same number of seconds apart, round after round.
- Impossible travel. Two checkpoints at opposite ends of a site scanned seconds apart.
- Rounds during breaks. Completed rounds that overlap with known meal or rest periods.
- Silence. Months of perfect rounds with zero incidents, zero photos, zero notes.
- Clustering. Most scans bunched at the start or end of the shift.
If you recognize two or more of these, read what ghost patrols are and how they hide in clean-looking logs.
Setting up checkpoints the right way also helps: mount tags where the officer has to physically stand, at a consistent height, and not next to a window or a desk. The steps are in how to add a QR code checkpoint in Trinity Guard, and placement principles are in patrol verification checkpoints.
The Short Version
A QR scan proves someone had the code. A validated QR scan is much closer to proving someone was standing at the checkpoint. If your clients are paying for patrols, that difference is the product.
Key Facts
- A standard QR scan only decodes a string of characters, so it cannot tell a printed checkpoint tag from a photo of that tag on another screen.
- GPS radius checks catch scans made far from a site but often miss a break room inside the same building.
- Trinity Guard® validates every QR checkpoint scan on its server in real time and uses an AI model to flag scans that look like photographed or repeated codes.
- A flagged scan is surfaced to a supervisor for review; the AI judges an image, not an officer.
- Because validation happens online, a QR-based round needs a data connection for the whole round, while outdoor GPS patrols record offline and sync later.
FAQ
Yes, on systems that only decode the QR string. The code on a photo is identical to the code on the wall, so a standard reader accepts it. The scan proves possession of the code, not presence at the checkpoint.
Partly. GPS catches a scan made off-site, but a break room or a car in the parking lot is often within the allowed radius, and indoor GPS can drift. GPS is useful context, not proof on its own.
Each scan is validated on the server in real time, and an AI model checks the scan for signs of a photographed screen or printout, or an image that has been used before. Irregular scans are flagged for supervisor review.
No. The model judges the image, not the person. A flagged scan is surfaced for inspection, and any consequence is a supervisor decision made on the full record.
Not with photo validation. Because the scan is checked on the server, a QR-based round needs a data connection for the whole round. For outdoor sites with weak coverage, GPS-based patrols record without coverage and sync later.
No. Trinity Guard® checkpoints are printed QR codes, and checkpoints are unlimited on every plan. Officers use their own or company smartphones running iOS 16 or later or Android 11 or later.
Run a 14-Day Guard Tour Pilot
Print your checkpoints, put them on the wall and see what a validated round looks like. No hardware, no credit card, live in under an hour.
Start your pilot →About the author: Gyula Györfi is the founder of Trinity Guard® and a former police commander with 26 years of police service, 18 of them in command. He builds patrol software that has to work where security work actually happens: on the phone in an officer's hand, on a night shift.
