QR codes on construction sites,
and what a scan is actually worth.

A QR code costs nothing to print and takes about three seconds to scan, which is exactly why it gets oversold. The code is the easy part. Whether the record it produces survives a payroll query, a client audit or a solicitor's letter eighteen months later is the part nobody demonstrates, and it has almost nothing to do with the code itself.

What the code actually is

A QR code is a two dimensional barcode. On a construction site it is normally printed on an A4 poster, laminated, and fixed to the site board or the cabin door. It holds a short string of data and nothing else. It is not a database, it does not know who you are, and it cannot record anything on its own.

That last point matters more than it sounds, because it decides how the whole arrangement behaves. There are two ways to build a site scanning system, and they are not equivalent.

The first is to make the code a web address. Point any phone camera at it and a page opens. This is the cheap version, and it is the one that produces the awkward conversation later, because a web address can be photographed and sent to somebody sitting at home. Nothing about the code distinguishes the person holding the phone from the person who was meant to be at the gate.

The second is to make the code meaningless to anything except your own app. A phone camera pointed at it opens nothing at all. The app resolves the code, and only for somebody already signed in as themselves. The identity comes from the login rather than from the poster, and the poster becomes what it should be: a way of saying which site, and nothing more.

The question worth asking any supplier is not whether the code is secure. Codes are not secure or insecure. It is what happens when somebody photographs the poster and sends it to a mate.

What a scan should record

A scan is worth having to the extent that it produces evidence somebody else will accept. Four things do most of that work, and a system missing any of them is producing an attendance note rather than a record.

• Who, established by the login. Not typed at the gate, not selected from a dropdown of names. The person is whoever signed into the app, which is why the app half matters as much as the code half.
• When, written by the server. A time read from the handset is a time the handset can change. Moving the clock forty minutes is not a sophisticated attack. A timestamp written server side cannot be back-dated from the phone.
• Where, captured with the punch. The location stored against the record, and shown to whoever approves it. This is evidence, not enforcement, and the difference is covered below.
• Which job, decided by the poster. This is the one people underrate. If the code carries the site, sub-site or plot, then the hour is attributed the moment it is recorded, rather than allocated from memory on a Friday afternoon.

A photograph taken at the moment of the punch sits alongside those. It is the cheapest form of proof available and the one that does most to change behaviour, because a face against a record is harder to argue with than a tick in a book.

Where the posters go, and how many

The number of scan points is a costing decision dressed up as a logistics decision, and it is worth taking deliberately.

One code for the whole site is the simplest thing to run. Every hour lands on the site, and if the site is the level at which you cost work, that is the right answer and there is nothing more to think about.

One code per plot, floor or sub-site changes what your job costing can tell you. A housebuilder with a poster on each plot gets labour cost per plot as a matter of record rather than apportionment. A fit-out contractor working three floors of the same building gets three costed rows instead of one lump. The cost of that precision is a handful of extra laminated posters.

Where the poster physically goes is a more practical question, and the answer is wherever the gang already passes. On a housing site that is usually the plot entrance. On spread out groundworks with no gate to speak of, it is the cabin. In a building it can be the lift lobby on each floor. A scan point that requires a detour will be resented within a fortnight and worked around within three.

What stops somebody scanning for a mate

Nothing stops it. Anybody who tells you otherwise is selling something. What a well built system does is raise the cost of it until it is more trouble than turning up, and it is worth being precise about how, because the individual measures are weak and the combination is not.

1. The photograph. Somebody clocking a colleague in has to produce a photograph at the moment of the punch. That is where most casual attempts stop.
2. The login. If identity comes from a signed in app rather than the poster, the second person has to hand over their credentials rather than forward a link. That is a different kind of favour to ask.
3. The location. Stored with the punch and visible to the approver, so a pattern of punches from the wrong place is discoverable afterwards even when nothing was blocked at the time.
4. The server timestamp. Removes the simplest correction of all, which is arriving late and adjusting the phone clock.

Put together, buddy punching stops being a thirty second favour and becomes a deliberate act involving somebody else's login and a photograph. That is a real deterrent and an honest claim. It is not prevention.

What a QR code cannot do

Three limits are worth knowing before anybody signs anything, because all three tend to surface after the decision rather than before.

A recorded location is not a geofence. Storing where a punch happened and refusing a punch that happens elsewhere are different features, and only one of them is normally switched on by default. A geofence sounds attractive until an operative is stood eighty metres away in a lay-by because the site entrance is on a bend, and the system will not let them start work. Recording the location and showing it to an approver keeps the human judgment in place. If you do want a distance check, ask for it explicitly and ask what happens when it fails.

A scan proves presence, not work. It records that a person was at a scan point at a time. It says nothing about what they did afterwards, and any supplier implying otherwise is describing surveillance rather than time recording.

It does not fix the rollout. This is the one that actually decides whether a system works. The paper route has to be closed on a named date, and supervisors have to expect the scan for the first fortnight and say so. Where field rollouts fail, they fail in about week three, for reasons that have very little to do with the software. That pattern is set out in why field app rollouts stall in week three.

Keeping the record, and for how long

Time records are not only a payroll convenience. The Working Time Regulations 1998 require employers to keep adequate records to show whether the weekly working time limit is being complied with, and HMRC expects payroll records to be kept for three years from the end of the tax year they relate to. A civil claim can arrive considerably later than either.

That is the practical case against a signing in book in a cabin. The book is accurate and complete right up to the day the cabin is demobilised, which is also the day it stops being findable. A record held against the person and the project outlives the site, and outliving the site is the entire point.

Where to start, on Monday

Pick a date three months ago and one site. Produce the list of who was on that site that day, with the times they arrived, and the job each hour was worked against. Time yourself doing it.

If the answer takes longer than a few minutes, or arrives as a photograph of a page in a book, the problem is not that you lack QR codes. It is that the record is being made somewhere other than where the work happens, and every argument you have later will start from a reconstruction rather than from evidence.