How to Stop Attendance Fraud: What Tech Can Detect
Fake GPS apps, phone clock changes, buddy punching, photos of photos and late uploads: what technology catches, what it misses and how managers review.
Attendance fraud on mobile clock-in usually takes one of five forms: fake GPS apps, changing the phone clock, buddy punching, re-photographing an old picture, and holding a photo back to upload later. Technology blocks a good share of this, but not all of it. This article takes an honest look at each one: what software can detect, where its limits are, and why a fair manager review process remains the most important safeguard.
The five common tricks
| Trick | How it is done | How common |
|---|---|---|
| Fake location | Install a mock-location app and pick a point on a map | Common with GPS-only attendance apps |
| Phone clock change | Set the system clock back to 07:55 and take the photo | Easy if the app trusts the device clock |
| Buddy punching | Hand your phone or login to a coworker | Common with every method |
| Photo of a photo | Re-shoot a screen or print to look like you are on site | Rarer, but hard to catch automatically |
| Late upload | Shoot at another time, stay offline, upload later | Happens where signal is weak; easy to abuse |
What technology can detect
Mock locations
Android and iOS both expose a signal indicating whether a position comes from a simulated source. An attendance app can check it on every location fix and block the capture when it trips. Be realistic, though: on a rooted or jailbroken phone, or with a tampered app, that signal can be bypassed. That is why you also need root and jailbreak detection and a server that re-checks every photo rather than trusting the phone.
Phone clock changes
This is the easiest trick to stop, provided the app never relies on the device clock. The answer is trusted time: sync with the server when online, then keep time with the system’s monotonic counter (which ignores manual clock changes) while offline. If the device clock drifts far from trusted time, the photo gets a clock drift flag. Our article on trusted time vs phone time explains the mechanism.
Late uploads
Every photo has two timestamps: when it was taken and when it reached the server. A big gap is normal on a construction site with no signal, but it is also worth a look. Systems should flag uploads beyond a threshold rather than reject them, so managers can judge the context.
Modified apps
An unofficial build can skip every on-device check. The server should confirm photos come from a valid app build and flag those that do not.
What technology struggles to detect
Sales material tends to skip this part. Managers should not:
- Buddy punching when the stand-in is physically on site. GPS and time are both valid; only the person in the frame differs. Without face recognition, this depends on the reviewer’s eyes. Make the rule explicit: clock-in photos must show the employee or identifying context (name badge, uniform, a recognisable spot).
- Photos of photos. Re-shooting a screen that displays a site picture still creates a new photo with a new time and location. If the person is at the site, the location is accurate, but the content may not reflect real work. Visual clues: screen bezels, moiré patterns, reflections, unusual blur.
- Sophisticated device tampering. No on-device check is absolute. A flag is a signal, not a verdict.
In short, technology narrows the room for fraud and highlights suspicious cases. The conclusion is still a human decision.
A fair manager review process
A simple, defensible routine:
- Filter by flags daily: outside geofence, mock location, rooted device, clock drift, late upload. Most days will have none.
- Read flagged photos in context: where does this person normally clock in, were they assigned elsewhere, does the site lose signal?
- Ask before concluding: contact the employee and record the explanation. One late upload caused by a dead zone is not fraud.
- Correct with a reason: every manual edit records the reason and who made it.
- Look at patterns, not single events: repeated flags over several weeks are what warrant action.
| Flag | Common innocent cause | What to do |
|---|---|---|
| Outside geofence | Indoor GPS drift, tight radius | Check the radius and the accuracy shown on the stamp |
| Mock location | Location spoofer installed for a game | Ask for it to be removed; restate the policy |
| Rooted device | Old or second-hand phone | Talk it through; consider another device |
| Clock drift | Time zone change while travelling | Compare with the trusted time on the stamp |
| Late upload | Basement or site with no signal | Usually acceptable if capture time makes sense |
Write the process down and share it in advance. Our guide to a photo attendance policy includes a template for appeals and corrections.
How SnapID Mark handles it
SnapID Mark follows one principle: the phone is a signal, the server re-checks.
- Trusted time syncs with the server; changing the phone clock does not change the time on the stamp, even offline.
- In a business workspace, when a mock location is detected the app blocks capture in every mode.
- Each photo can carry integrity flags: mock location, rooted or jailbroken device, clock drift, outside geofence, late upload (more than 15 minutes), invalid app build.
- The stamp is created at the moment of capture inside the app, with a SnapID code and QR. Anyone who receives the photo can verify the code and compare a file with the original using a SHA-256 fingerprint computed in their own browser.
- Admins review flagged photos in the web dashboard and make manual corrections with a change log.
SnapID Mark has no face recognition and does not track location in the background. Preventing buddy punching relies on photos of real people, a clear policy and manager review.
FAQ
Can an app block 100% of fake GPS?
No app can promise that. Combining on-device mock detection, root detection and server-side re-checks stops the large majority of everyday attempts.
Are clock-in selfies enough to stop buddy punching?
They help a lot because everyone can see who is in the picture, but someone still has to review. SnapID Mark does not perform automatic face recognition.
Does a flagged photo mean the employee cheated?
No. A flag means “take a look”. Many flags have innocent causes such as dead zones or weak GPS.
Does a late upload change the recorded clock-in time?
Not when the app uses trusted time. An offline photo keeps its capture time; the late-upload flag simply tells the manager.
Want more transparent attendance without turning the workplace into a place of suspicion? Download SnapID Mark and start with a clear review routine.