A geofenced time clock is a simple idea with a lot of hidden edges. Draw a circle around the client site, and an officer can only clock in while their phone reports a position inside it. No more punching in from the parking lot of the taqueria down the road, no more a partner clocking someone in who is still twenty minutes out. In practice, the technology delivers most of that — and then produces a category of problem nobody warned you about, usually at a large industrial site at 4 a.m.
Understanding what the geofence actually proves is what separates an operation that uses it well from one that spends every Monday overriding false flags.
What a geofence can and cannot prove
It can prove that the device that submitted the punch reported a position consistent with being at or near the site, at that moment. That is genuinely useful. It kills the most common attendance fraud in contract security, which is not elaborate — it is an officer clocking in from home or from the road so the drive counts as paid time.
It cannot prove that the officer is the person holding the phone. It cannot prove they stayed. It cannot prove they were awake, at the post rather than the far end of the property, or doing anything at all. And it cannot prove the position was honest, because location can be spoofed on a phone with modest effort.
That last point matters and gets glossed over. Anyone selling you a geofence as tamper-proof is overselling. What a well-implemented system does is raise the effort required to cheat well above the effort required to just show up, and produce a record consistent enough that exceptions stand out. That is a reasonable goal. “Impossible to defeat” is not.
The practical strengthening move is to stop relying on location alone. Pair the geofence with a selfie captured at the moment of the punch, and you have tied the punch to a face as well as a place. Pair it with a scan of a QR tag physically mounted at the post, and you have tied it to an object that cannot be carried home. A QR guard tour system used at clock-in is a stronger proof of presence than coordinates alone, because the tag is bolted to the wall.
Why GPS drifts, and where it drifts worst
Phones do not know where they are. They estimate, from satellites when the sky is visible, and from Wi-Fi networks and cell towers when it is not. The estimate comes with an accuracy radius, and that radius varies enormously by environment.
The places it degrades are exactly the places security officers work:
- Underground parking structures and loading docks. No satellite view. The phone falls back to whatever it can hear, which can be a network on a different floor or a different building.
- Steel and concrete interiors. Warehouses, plants, data centers. A punch from a guard shack outside reads clean; a punch from inside the same building can land hundreds of feet off.
- Dense downtown cores. Signals bounce off towers and arrive late, and the phone computes a position that is confidently wrong. Officers working high-rise lobbies see this constantly.
- Very large sites. A campus, refinery or distribution yard can be a mile across. A geofence tight enough to be meaningful at the front gate excludes the officer clocking out at the back of the property.
Add a cold start — a phone that has just been turned on, or come out of airplane mode, or spent an hour indoors — and the first reading can be badly stale before it settles.
None of this is a defect in the software. It is the physics of consumer positioning, and the design of your policy has to account for it.
Setting a radius that works
The instinct is to draw the circle tight, because tight sounds rigorous. Tight circles generate false rejections, false rejections generate workarounds, and workarounds are how you end up with a supervisor who clocks everyone in manually every morning — which is a worse control than what you started with.
A better approach:
Size the geofence to the property, plus a margin. Start from the actual footprint of the client site, then add enough buffer to absorb typical accuracy error in that environment. A suburban strip retail account needs less buffer than a downtown tower.
Set it per site, never globally. One company-wide radius guarantees it is wrong somewhere. Every account has its own geometry and its own signal environment.
Use multiple points on large sites. A single center point cannot serve a property that spans half a mile. Anchor the fence to the post where the officer actually reports.
Decide what happens on failure before it happens. There are two philosophies. A hard block refuses the punch outright. A soft flag allows it, records the reported distance and accuracy, and pushes it into an exception queue for supervisor review.
For contract security, the soft flag is almost always the right choice. A hard block means an officer standing at the correct post with a bad signal cannot start their shift, and the resolution path — call dispatch, wake a supervisor, get a manual override — costs more than the fraud it prevented. A soft flag catches the same behavior after the fact, without ever leaving a post in limbo.
Reviewing the exceptions is the actual control
A geofence with no review process is theater. The value comes from someone looking at the flagged punches on a regular cadence and asking a simple question: is this a pattern or an environment?
- One officer, many sites, consistently far off — that is a person question.
- Many officers, one site, consistently far off — that is a geofence question. Widen it or move the anchor.
- The same officer at the same site always flagged at clock-in but never at clock-out — that is a commute question, and it is the classic finding.
- Punches with a very large reported accuracy radius — that is a signal question, not misconduct. Underground or deep indoors.
Reviewing exceptions weekly, per account, takes very little time and is what turns location data into a management tool rather than a pile of coordinates. Guard time and attendance that surfaces these as a short exception list, rather than requiring someone to read every punch, is the difference between a control that gets used and one that gets ignored.
Handling it with officers
Two things prevent this from becoming a morale problem.
Explain the purpose honestly. The geofence exists so the company can prove to the client that the post was staffed, and so officers get paid correctly for hours they actually worked. Both of those benefit the officer. Framing it as surveillance invites it to be treated as surveillance.
Never let a technical failure cost someone their pay. State clearly that if the app cannot confirm location, the officer works the post and reports it, and the punch is reconciled afterward. An officer who believes a bad GPS reading might cost them four hours will find a way around the system, and they will be right to.
Also be clear about scope. Location captured at the punch is different from continuous tracking, and different jurisdictions treat employee location data differently. Employee monitoring, consent and privacy requirements vary by state and can change; confirm your obligations with employment counsel and disclose what you collect in writing. This article is operational guidance, not legal advice.
What a good geofenced time clock setup looks like
A geofenced time clock is one layer. On its own it answers “was a phone near the site.” Combined with a selfie, a physical tag scan at the post, a shift schedule that says who should be there, and a supervisor reviewing exceptions weekly, it answers something much closer to the real question: was the post staffed by the right officer for the hours we are about to bill.
Build the layers, size the fences per site, flag rather than block, and review the exceptions. If you want to see how location, photo verification and tag scans come together in one attendance record, explore CGuardPro or get in touch.