Selfie + GPS Attendance: How to Stop Proxy Punching Without Annoying Your Staff
A practical guide to mobile attendance for Indian businesses: geofence radius, selfie checks, fake GPS detection, offline punches, kiosks for workers without smartphones and privacy rules.
pagar karo Payroll Desk· Published 28 Aug 2026· Updated 28 Oct 2026· 3 min readTo stop proxy (buddy) punching, require a live selfie with every punch, allow punches only inside a geofence around the work site (usually 100–300 metres), flag mock-location apps and review exceptions instead of blocking everything. For workers without smartphones, use a shared face-recognition kiosk with a liveness check. Tell staff clearly what is collected and why.
- Selfie + geofence stops most proxy punches; liveness checks stop photo-of-a-photo tricks on kiosks.
- Start with “flag for approval” rather than “block” — you learn where the geofence is too tight.
- Offline punches must carry a unique ID so they are never counted twice.
- Collect only what you need, during working hours, and tell staff in a written notice.
Why registers and fingerprint machines aren’t enough
Paper registers invite “I’ll sign for him”. Fingerprint machines stop that but break down with dusty or worn fingers, need one machine per gate and don’t work for staff in the field. Phone-based attendance with a selfie and location solves both — if it’s set up sensibly.
The four layers of a trustworthy punch
- Who — a live selfie (and on kiosks, a face match with liveness).
- Where — the phone’s GPS position inside the work-site geofence, with accuracy recorded.
- Which device — the registered phone; one active login per person.
- When — server time, not the phone’s clock, with offline punches time-stamped and synced later.
Setting the geofence
| Site type | Suggested radius |
|---|---|
| Office or shop | 100–150 m |
| Mall store or hospital | 150–250 m (GPS drifts indoors) |
| Factory campus, warehouse | 200–500 m |
| Construction site | Plot size + 100 m |
Handling fake GPS and other tricks
- Mock-location apps: detect and flag or block.
- Low accuracy: set a minimum accuracy (e.g. 100 m); weaker fixes go for approval.
- Selfie of a photo: managers can review selfies; kiosks need liveness detection.
- Shared phones: one active device per person, remote sign-out for lost phones.
Offline punches
Basements, factory sheds and highways lose signal. The app should save the punch with a unique ID and the time, then send it when the network returns. The server must accept each ID once — so a punch retried five times is still one punch.
Staff without smartphones
Put a face kiosk — an Android tablet — at the gate. Staff look at the camera; the kiosk matches encrypted face measurements (not photos) and checks liveness. People not yet enrolled punch with a PIN that goes for approval. Already have biometric machines? Sync their logs instead.
Privacy and trust
- Give a written notice: what is collected (photo, location at punch time), why, and for how long.
- Collect location only at punch time — or, for field staff, only while punched in.
- Encrypt face data and delete it when someone leaves.
- Let staff see their own punches and selfies in the app.
A two-week rollout plan
- Day 1: create sites with geofences and an attendance template.
- Day 2: import staff, send app invites by SMS, run a 10-minute demo for supervisors.
- Week 1: run alongside the register; approve exceptions daily.
- Week 2: tune radius and grace minutes; retire the register.
Frequently asked questions
What geofence radius should I use?
For a shop or office, 100–150 m. For a factory campus or construction site, 200–500 m depending on the plot size. Phones in dense buildings can be 30–80 m off, so test a few punches first.
Can staff fake their GPS location?
Mock-location apps exist. A good attendance app detects them on Android and either blocks the punch or flags it for approval, and stores the reported accuracy with each punch.
Is selfie attendance legal in India?
Collecting attendance data for employment is a common legitimate use, but under the Digital Personal Data Protection Act, 2023 you should give staff a clear notice, collect only what you need, protect it and keep it for a limited period.
This guide is general information for employers in India, checked against the sources above on 28 Oct 2026. Rules and rates change — confirm with your CA or the official notification before acting.