QR Code vs NFC Guard Tour: Which Checkpoints Should You Use?

The quick answer

Use QR codes for most checkpoints. They print on any printer, almost any phone's camera reads them, and in PatrolBadges' patrol mode they keep scanning with no signal. Use NFC tags where a printed code isn't enough: places where a code might be photographed and scanned from somewhere else, spots exposed to weather or vandals, and the checkpoints where proof matters most.

You don't have to pick one for the whole site. Most routes work best as a mix.

QR codes and NFC tags, side by side

Which phones can read NFC tags

iPhone

Apple says "iPhone XS and later support background tag reading." That means the phone reads a tag with no app open. If the tag holds a web link, the iPhone shows a notification, and tapping it opens the link in Safari. A locked iPhone asks to be unlocked first.

Apple lists a few times background reading is unavailable: when the phone hasn't been unlocked since it restarted, while an app is already reading NFC, while Apple Pay Wallet is in use, while the camera is in use, and in airplane mode. Tell officers to close the camera before they tap.

Older iPhones need an app. When Apple first opened NFC tag reading to apps in iOS 11, its WWDC 2017 session said "Tag reading is supported on iPhone 7 and iPhone 7 Plus," and reading had to start from inside an app. For an officer with an older iPhone, put a QR code beside the tag.

Android

Many Android phones have NFC, but it can be switched off in settings. Before a tag goes on a route, have each officer tap a test tag with their own phone. If someone's phone can't read it, they scan a QR code instead.

Is NFC the same as RFID?

Close. NFC is a short-range kind of RFID. Its standards are based on existing RFID standards, including ISO/IEC 14443. It uses a frequency of 13.56 MHz and works over about 4 cm (1.5 inches) or less. The tag has no battery: the phone's radio field powers it during the tap.

So every NFC tag is an RFID tag, but not every RFID tag is NFC. If you're replacing an older RFID wand system, ask its maker what its tags are before you assume a phone can read them.

What's inside an NFC tag

NXP's NTAG chips are a family of three. The NXP datasheet gives their sizes:

All three are NFC Forum Type 2 tags built on ISO/IEC 14443 A. Each has a 7-byte unique ID and an NXP originality signature, can be protected with a 32-bit password, keeps its data for 10 years and takes 100,000 writes. PatrolBadges works with any NTAG213 or NTAG215 tag.

Can QR checkpoints be faked?

Yes, and it's the known weakness of QR guard tours. A QR code is just a picture, and a photo of it decodes exactly like the original. An officer could photograph every code on the route once, then scan the photos from the break room for the rest of the year.

NFC tags are harder to fake, not impossible. A tag has to be tapped where it is, so there's no picture to carry around. But a tag that holds a plain web link can be read, and that link written to a second tag the officer keeps in a pocket. Locking a tag after you write it stops anyone rewriting it; it doesn't stop a copy. And when a tap simply opens a web link, as it does in a browser-based system like PatrolBadges, the system sees the link, not the chip's ID, so a copy opens the same page.

What catches both is checking where and how each scan happened:

• Location stamps. Each scan is compared with the checkpoint's pinned spot, and a scan from too far away is flagged.
• Too-fast flags. Two checkpoints scanned seconds apart that are minutes apart on foot get flagged.
• Photo checkpoints. A checkpoint can require a fresh photo before the visit logs: the gauge, the lock, the open fire door. It can't be taken from the break room.
• Placement. Put codes and tags where using them means standing there: inside a door frame, on the riser room wall, beside the gate.
• Spot checks. Walk the route yourself now and then, at an hour nobody expects.

PatrolBadges does the first three on every plan. How to verify security patrols covers the other common tricks.

Where wands and touch buttons still win

Before phones, guard tours ran on wands: a rugged reader touched to a metal button at each checkpoint. They're still sold. Deggy's online store, for example, lists:

Wands win where phones don't fit: sites that ban phones, officers who don't carry one, and places rough enough to break one. A metal button is also hard to copy. The trade-offs are hardware to buy, charge and replace, and timing: a pen's records reach the system when it's downloaded at the station, so ask how soon a missed round would reach you. Guard tour wand alternatives compares the two in detail.

Offline: stairwells, basements and garages

Whether a checkpoint works with no signal depends on the system, so ask. In PatrolBadges:

• QR codes work offline in patrol mode. After the first scan of a shift, officers keep scanning from patrol mode's camera screen. Each scan is saved on the phone first and sent when there's signal, with the time it really happened. Scans sent late are marked, so the record stays honest.
• NFC taps need signal. A tap opens the checkpoint's link in the browser, and the page has to load to log the visit.

So in a dead zone, use a QR code, even if the rest of the route is NFC.

Which to use where

Mixing is normal. In PatrolBadges, QR codes and NFC tags work on the same route, and each NFC visit is marked as one, so the report shows how every checkpoint was reached. See NFC guard tours for how to write and lock the tags.