Blog/Technology

QR codes or NFC tags: what actually proves a guard was there

5 min read

A guard tour system has one job: to prove that someone stood at a checkpoint at a certain time. How that checkpoint is marked decides whether the proof holds up when a client, an assessor or a court asks.

QR codes are easy to copy

A QR code is a printed pattern. Anything that can see it can copy it: a phone photo, a photocopier, a screenshot sent over chat. Once a copy exists it can be scanned from the guard house, and the system has no way of telling the difference.

Basic NFC tags are better, but they are not proof

NFC needs the phone within a few centimetres of the tag, which rules out scanning a photo. But a basic tag carries a fixed serial number, its UID, and that number can be read and written onto a blank tag. A cloned tag kept in a drawer scans exactly like the one on the wall.

Secure NFC tags change the answer

Tags such as NXP’s NTAG 424 DNA hold a secret key. On every tap they produce a fresh code, which NXP calls a Secure Unique NFC message, with a counter inside it. The server checks the code with its own copy of the key and remembers the counter, so a replayed or copied code is rejected.

Rule of thumb: a QR scan proves someone saw a code. A secure NFC tap proves a phone touched that tag, at that moment.

Four questions to ask any vendor

  • Can a photo or photocopy of a checkpoint be scanned?
  • If a tag is cloned, does the server notice?
  • Is the check done on the phone, or on the server?
  • What happens to taps made where there is no signal?

SentryOps matches every tap to the tag’s registered serial number on the server, and records the guard, the time and the place. That rules out photos and photocopies. A basic tag can still be copied by someone determined, so SentryOps also watches for the signs that usually give a faked patrol away: fake GPS, clock changes and unknown phones. Secure tags with one-time codes are coming for sites that need copy-proof taps.

Ready to upgrade your security operations?

30 minutes, on a call or at your office. Bring a floor plan and we’ll map your first patrol route with you.