QR Code Jobsite Sign In vs Facial Verification: Which Is Safer?

QR Code Jobsite Sign In vs Facial Verification: Which Is Safer?

For proving who is on site, facial verification is safer than QR code jobsite sign in. A QR scan proves a phone scanned a code. It does not prove who held the phone. BiltOn is a Safety Intelligence platform that verifies every worker at the gate with 3D facial recognition, so every record behind its Predictive Safety Management scores belongs to a real person. QR sign in still works for some jobs, and face checks bring privacy duties that a general contractor (GC) must plan for. This guide compares the methods fairly.

How does QR code jobsite sign in work, and what can it prove?

A QR code jobsite sign in lets a worker scan a posted code with a phone and fill out a form. The scan proves one thing: a phone read that code at that time. A QR code is just data stored in a square pattern, and DENSO WAVE announced it in 1994 as a faster kind of barcode. The sign in tool then trusts whatever the worker types. That makes QR cheap and quick to start. It leaves one question open: who was holding the phone?

The U.S. Department of Labor says employers "may use any timekeeping method they choose," but they must still record the hours worked each day. So the real test is how well the record holds up. Here is what a QR scan can and cannot show.

• It can show that a phone scanned a code, and when.

• It cannot show who held the phone. A worker can hand the phone to a friend or forward the link.

• It cannot show the code is the real one. The FBI warns that criminals "replace legitimate codes with malicious codes," so a gate sticker could be swapped.

• It cannot show that a typed name is true. Add-ons such as location checks may show the phone was near the site, but they still do not name the person.

This gap has a name. Buddy punching means one worker clocks in or signs in for another. It leads to time theft, which is pay for hours not worked. Many vendors publish buddy punching percentages, but we could not trace one to a neutral source, so we leave them out. The table shows how each method handles it.

QR sign in is a fair way to count heads on small or low-risk jobs. It is a weak way to prove identity. If a claim or an audit turns on who was there, a scan alone will not carry the weight. Our guide to construction site access control, from check-in to verified identity, shows the next step.

How accurate is facial verification, and what does NIST measure?

The U.S. National Institute of Standards and Technology (NIST) runs the best known public test of face matching. Its Face Recognition Technology Evaluation (FRTE), formerly called FRVT, has a 1:1 verification track. The "1:1" means the system checks one face against one claimed identity, which is what a gate does. NIST counts two errors. The false non-match rate (FNMR) is how often the right person is turned away. The false match rate (FMR) is how often a wrong person gets in. NIST ranks systems by FNMR at an FMR of 0.000001, or one wrong match in a million tries.

Those lab scores have limits. NIST measures FNMR on medium-quality airport immigration entry photos compared with high-quality reference portraits. A busy jobsite gate looks different. Use NIST results to compare systems, not as a promise for your site.

A real example shows why this matters. In 2019, NIST tested 189 software algorithms from 99 developers on 18.27 million images of 8.49 million people. For one-to-one matching, it found higher rates of false positives for Asian and African American faces than for Caucasian faces. The gap often reached 10 to 100 times, depending on the algorithm. NIST adds that a false negative may be "merely an inconvenience," because a second try usually fixes it. A false positive can "allow access to impostors."

Matching is only half the story. A separate NIST track, FATE PAD, tests how well software spots fake faces. PAD stands for presentation attack detection, such as showing a photo or video to the camera. Its 2023 report scored 82 passive PAD algorithms that work on conventional 2D imagery, with software only. BiltOn describes its gate check as 3D facial recognition. Ask any vendor, BiltOn included, to show how photos and screens are handled and how that was tested.

No lab score can promise results on your site. Ask each vendor for its NIST results and test on your own crews. Keep a backup path for workers the system misses.

What legal and privacy steps should a GC check before using facial verification?

Check the biometric privacy rules in every state and city where you build, because they differ. The items below are things to check with counsel. This is not legal advice.

• Illinois Biometric Information Privacy Act (BIPA). The law lists a scan of face geometry as a biometric identifier, and it excludes photographs. Before collecting one, a company must give written notice, state the purpose and how long it will keep the data, and get a written release. It must also publish a retention policy and destroy the data within three years of the person's last contact, or sooner if the purpose ends. For workers, a release can be one signed as a condition of employment.

• Damages are $1,000 for each negligent violation and $5,000 for each intentional or reckless one, plus legal fees.

• On February 17, 2023, the Illinois Supreme Court held in Cothron v. White Castle that a claim accrues with each scan.

• In Rogers v. BNSF, a federal jury found 45,600 violations and a $228 million award. The case later settled for $75 million.

• In August 2024, Illinois changed the rule. Repeat scans of the same person by the same method now count as one violation, with at most one recovery. An electronic signature can now serve as the release.

• New York City biometric law (Admin. Code Title 22, Chapter 12). The law covers a "commercial establishment," which it defines as a place of entertainment, a retail store, or a food and drink establishment. Those businesses must post a sign near customer entrances, and the law bans selling or trading biometric data. A construction site is not on that list, so the sign rule may not reach it. One law firm reads the ban on profiting from the data as covering a broader group of businesses. Ask counsel whether any retail or food space on your project is covered.

• New York Labor Law 201-a. The statute says that "no person, as a condition of securing employment or of continuing employment, shall be required to be fingerprinted," with listed exceptions. A face scan is not a fingerprint, but ask counsel how the rule applies to your setup.

• Notice, consent, and retention. Give workers written notice of what you collect and why. Get written consent. Set a date for deleting the data. Never sell or trade worker face data. Put the vendor's duties in the contract. Plan a non-face option for workers who decline.

Privacy duties are real, and they are manageable when planned early. QR and badge systems carry fewer duties, but they also prove less. For projects where identity matters most, such as data center builds, see our guide to access control for data center construction.

What does one false injury claim cost, and how does a verified record change it?

A false injury claim is costly even when you win. BiltOn estimates that defending one can cost a GC $50,000 or more. That figure is BiltOn's estimate, not an industry study. The cost is staff time spent hunting for proof, plus legal fees. Most claims turn on one fact: was this worker on site that day? The table shows how each kind of record answers that question.

SD Builders, a New York City GC, shows the pattern. It replaced badge swipes with facial verification turnstiles. It reports zero false workers' comp claims since. It also dismissed one claim outright for a date the worker never badged in. That is the value of a record built at the gate. For more on this idea, read claims defensibility: building a site record that holds up.

Proof built at the gate costs far less than proof pieced together after a claim. A verified entry gives you the one fact the claim depends on.

How does BiltOn verify who is on site?

BiltOn verifies every worker at the gate with 3D facial recognition. Each check is tied to an employer, a trade, an orientation status, and a set of credentials. Every check-in and check-out is timestamped by site, including shifts that cross midnight and sites in different time zones. The attendance and hours record by worker and employer can be exported. It syncs two ways with Procore and Autodesk, both BiltOn partners. It is kept in a tamper-evident form that was piloted in the work behind NYC Buildings Bulletin 2024-007.

• Fast crew onboarding. At Lettire, onboarding a 30-worker crew took about two hours before verified access. After 3D facial verification, crews self-onboard in minutes through SMS and browser signing, and every entry and exit is a time-stamped event.

• Fewer false claims. Clients report roughly three fraudulent claims prevented per project (client-reported).

• Safety work tied to a real person. Pre-task plans are tied to a verified identity, and inspections carry a photo and a timestamp.

The privacy steps above apply to BiltOn as they do to any facial system. Plan notice, consent, and retention with counsel before launch. A gate that workers skip proves nothing, which is why consistent use decides your insurance premiums.

As Omer Slavin, Co-Founder and CEO of BiltOn, puts it: "See every site, verify every worker, prove every record."

Request a demo and we will show you how BiltOn puts this to work on your sites. Book a demo at bilton.tech/demo.

Executive takeaway

A QR scan proves a phone read a code, not who held the phone, so it is weak proof of identity. Paper sheets and badges share the gap, because names can be signed and cards can be lent. Facial verification closes it when the match is accurate and fake faces are blocked. NIST's tests help you compare systems, but they use lab photos, so test on your own crews. Face checks also bring duties under laws such as Illinois BIPA, so take notice, consent, and retention to counsel first. When a false injury claim comes, a verified entry for the right worker on the right day is the proof that matters.

Frequently Asked Questions

1. Is QR code jobsite sign in secure?

It can count scans, but it cannot prove who did the scanning. A worker can pass a phone to a friend, and the FBI warns that physical QR codes can be swapped for fake ones. A scan alone does not name the person.

2. Does facial verification stop buddy punching on construction sites?

It removes the easiest ways to do it, because the system checks the face and not a card, a phone, or a pen. It works best when fake faces are blocked. Ask any vendor to show how it handles photos and screens.

3. What does NIST test in face recognition?

NIST's FRTE program tests how often systems reject the right person and how often they accept a wrong one. A separate track, FATE PAD, tests software that spots fake faces. The tests use lab images, so they help you compare vendors but do not promise results at your gate.

4. Do I need consent to use facial recognition on a jobsite?

It depends on the state and city. Illinois BIPA requires written notice and a written release before a company collects a face scan. New York City's biometric law lists entertainment, retail, and food and drink businesses. These are things to check with counsel, not legal advice.

Works Cited

• DENSO WAVE. (n.d.). The history of QR Code. QRcode.com.

• U.S. Department of Labor, Wage and Hour Division. (n.d.). Fact Sheet #21: Recordkeeping Requirements under the Fair Labor Standards Act (FLSA). dol.gov.

• FBI Internet Crime Complaint Center. (2022). Cybercriminals tampering with QR codes to steal victims' funds (public service announcement). ic3.gov.

• National Institute of Standards and Technology. (2026). Face Recognition Technology Evaluation (FRTE) 1:1 Verification. NIST.

• National Institute of Standards and Technology. (2019). NIST Study Evaluates Effects of Race, Age and Sex on Face Recognition Software. NIST.

• National Institute of Standards and Technology. (2023). Face Analysis Technology Evaluation (FATE) PAD. NIST.

• Illinois General Assembly. Biometric Information Privacy Act, 740 ILCS 14. ilga.gov.

• BakerHostetler. (2023). Illinois Supreme Court: Sections 15(b) and 15(d) BIPA claims accrue with each scan or transmission (Cothron v. White Castle System, Inc., 2023 IL 128004). BakerHostetler.

• Willis Towers Watson. (2024). Illinois amends BIPA: A new limit on damages for biometric privacy violations. WTW.

• Seyfarth Shaw LLP. (2024). BIPA legislative update: Governor Pritzker signs amendment limiting damages to a single recovery. Seyfarth.

• New York City Council. (2021). Local Law 3 of 2021 (Admin. Code Title 22, Chapter 12, biometric identifier information). intro.nyc.

• Kramer Levin. (2021). New York City's biometric privacy law takes effect: What you need to know. Kramer Levin.

• New York State Senate. Labor Law section 201-a, Fingerprinting. nysenate.gov.

• New York City Department of Buildings. (2024). Buildings Bulletin 2024-007. nyc.gov.

• BiltOn. (2026). Construction Site Access Control: From Check-In to Verified Identity; Access Control for Data Center Construction; Claims Defensibility: Building a Site Record That Holds Up; Why Consistent Safety Platform Adoption Decides Your Construction Insurance Premiums. bilton.tech.