Ghost Patrols: How Security Patrol Fraud Works, and How It Is Detected

A ghost patrol is not an administrative error

It is worth being precise about what is at stake, because the phrase sounds clerical and the consequence is not.

When a patrol is falsified, three things happen at once. The site is unguarded during the window the record claims it was covered. The client holds a document stating the opposite. And the security company has accepted liability for a service it did not deliver, in writing, in advance.

The order matters. The exposure exists from the moment the false record is created — not from the moment something goes wrong. Most operators discover a ghost patrol only after a theft, a fire, an unauthorized entry, or an injury, when someone pulls the log and compares it against what actually occurred. By then the record is no longer a management document. It is evidence, and it is evidence against the company that produced it.

This is why the topic sits close to insurance and contract law in the United States. A falsified patrol record is a defect in the service, a weakness in a claim, and a plausible reason for a client to terminate. It is also a document that can end up in front of a court, where routine operational logs are handled under the business records exception to the hearsay rule — an exception that rests on the assumption that whoever made the entry had first-hand knowledge of what they were recording. Operators tend to underestimate it because nothing appears to be wrong until everything is.

How ghost patrols are actually created

In 26 years of law enforcement and security work — including as a regulatory inspector of private security firms — I have seen the same problem solved by field staff with genuine ingenuity in every technology generation. It is worth cataloguing the methods honestly, because a system that has not been designed against them will not catch them.

Paper falsification

The oldest and simplest method. Times, initials, and observations are entered into a logbook or a pre-printed inspection sheet after the fact, or invented outright. Nothing in the document connects the writing to a physical presence at a location.

The structural flaw of paper is that it is editable after the fact, back-datable, and unlinked to reality. It records a claim, and it records it in the handwriting of the person making the claim.

Mechanical and touch-point defeat

Early watchclock and touch-button systems introduced hardware, which introduced hardware workarounds. Checkpoints were unscrewed and relocated to a convenient position, so an entire route could be walked in a corridor. Buttons were duplicated. Devices were carried by someone else.

The most instructive case I know of involves neither electronics nor sophistication. An officer trained his dog to touch the checkpoints along the route. The dog ran the patrol; the officer rested; the reader recorded a clean set of timestamps. Every scan in that record was authentic. The patrol was not.

That story is worth keeping in mind whenever a vendor describes checkpoint contact as proof. The device recorded exactly what it was built to record. It was built to record the wrong thing.

RFID tag manipulation

RFID checkpoints raised the cost of defeat without eliminating it. Tags can be removed, relocated, or cloned with inexpensive equipment. Once a tag is off the wall, the checkpoint is wherever the officer wants it to be, and the system has no way to know.

This is the structural reason satellite-verified checkpoints behave differently: a coordinate cannot be unscrewed and carried to a more comfortable location.

QR code photography

Mobile systems brought the most widespread current method, and the simplest. The officer photographs the indoor QR codes once, then scans the photographs from a phone or a printed sheet instead of walking the route.

The scan is real. The code is correct. The timestamp is genuine. The patrol did not happen.

Why older systems cannot catch this

The pattern across all four methods is the same: each system records an event and treats the event as proof of a fact. The event is real. The inference is wrong.

A system that records only a scan can confirm that a scan occurred. It cannot answer the questions that determine whether a patrol occurred:

• Was the officer physically at that location?
• Was the check performed within the scheduled window?
• Was it performed at the checkpoint, or near a copy of it?
• Was the event live, or a replay of a captured artifact?
• Was the full route completed, or only its most convenient segment?
• Did an actual environmental inspection take place, or only a data entry?

Answering these requires continuous visibility of where officers actually are during a shift, not a list of successful scans. Any verification approach that cannot address them is recording activity rather than verifying service. This is a design limitation rather than a product defect, and it is worth naming plainly when evaluating any system, including ours.

What actually detects a ghost patrol

Detection does not come from a better scan. It comes from context — evaluating the scan against everything else known about the shift.

A verification layer capable of catching the methods above generally combines:

Position, not just presence. Outdoor checkpoints verified by GPS coordinate rather than by contact alone, so relocation of a physical marker does not relocate the checkpoint.

Tamper-resistant physical markers. Indoor codes that are difficult to duplicate — holographic or otherwise physically distinctive — so a photographed copy is not equivalent to the original.

Circumstantial analysis. Automated review of whether the scan is consistent with the shift: the time, the sequence, the interval between checkpoints, the movement pattern, and the visual characteristics of the scan itself. A photograph of a QR code does not behave like a QR code on a wall, and that difference is measurable. We covered the underlying method in more depth in our breakdown of what patrol data reveals when it is analyzed rather than stored.

Exception surfacing in real time. A supervisor who learns about an anomaly three days later is doing forensics. A supervisor who learns in the same shift is doing supervision.

The technical principle underneath all of this is simple to state: fraud is detected by inconsistency, not by data volume. A system that collects more of the same kind of evidence does not become harder to defeat. A system that collects independent kinds of evidence does, because a defeat method now has to satisfy all of them at once.

"Why would an officer work better because of an app?"

This is the most common objection I hear, and it deserves a serious answer rather than a marketing one.

People look for the edges of what is measured. This is not a characteristic of security officers; it is a characteristic of workers, and I include myself. In 26 years of command I have never seen a team whose discipline was independent of whether the work was verifiable. Where performance cannot be checked, standards drift — not because people are dishonest, but because effort follows accountability.

There are legitimate contributing factors in this industry: low pay, difficult conditions, night shifts, and a profession that is chronically undervalued. None of them change the underlying mechanism. When an officer knows the round is objectively verifiable, the round is far more likely to be walked.

This is also why the tool has to stay simple enough to survive a real shift. A verification system that adds friction gets defeated faster than one that does not — a principle military engineering settled long before our industry did, and one we examined in why simplicity is an operational requirement rather than a design preference. The same conclusion came out of the three years of live field testing that shaped this platform.

The half of this that most vendors ignore

Fraud detection is the obvious application, and it is the smaller one.

The same data that exposes a missed checkpoint also makes consistent performance visible. In most security operations, the only officer whose name reaches management is the one who failed. The officer who completes every task, walks every point, and stays alert at 3 a.m. produces a record indistinguishable from silence.

That asymmetry is expensive. Turnover is this industry's defining cost, and turnover is driven substantially by the fact that good work is invisible. A verification system that only catches failure reinforces the problem it was bought to solve.

The same GPS, checkpoint, task, and shift data supports the opposite use. It gives a supervisor a factual basis for recognition rather than an impression. We wrote about this at length in how patrol data can motivate officers rather than only catch them.

Evaluating a system against ghost patrols: a buyer's checklist

If you are assessing guard tour software — from any vendor — these are the questions that separate recording from verification. Ask them of every system on your shortlist, including ours. For a broader view of what is currently on the market, see our comparison of the leading platforms and what they actually verify.

1. Does the system verify position independently of the checkpoint marker? If the only evidence is contact with a tag, relocating the tag defeats it.
2. Can an indoor checkpoint be photographed and scanned remotely? Ask the vendor to demonstrate what happens when you try. The answer is more informative than the datasheet.
3. Does anything analyze the scan's circumstances, or only its existence? Time, sequence, interval, and movement pattern are the signal.
4. How quickly does an anomaly reach a supervisor? Same-shift is supervision; next-week is archaeology.
5. Is the record exportable in a form a client or an insurer will accept? A verification system that produces evidence nobody outside the company can read has solved half the problem. High-consequence sites make this obvious — see how patrol reporting works on pipeline and critical infrastructure contracts, where the report is the deliverable.
6. Can the same data be used to recognize good performance? If not, expect adoption resistance and continued turnover.
7. What happens offline? Remote sites, industrial interiors, and underground areas are exactly where patrols are hardest to verify and easiest to skip.

A system that answers all seven is not necessarily the cheapest option. It is the one that produces a record you can defend.

Frequently asked questions