The new-device alert: when a check-in looks fine but isn't

For most weeks, every staff phone is the same one as last week. Lyhour clocks in from her iPhone, Sokha from his Pixel. The pattern is so steady that when it breaks, the break is the signal.

That's the new-device alert. The moment someone clocks in (or out) from a phone they've never used before on this account, DailyBrew pings the owner — push, Telegram, and now email in parallel, so it reaches you whether the app is open, you're in the kitchen, or you only check your inbox in the morning.

Why first-time-on-this-device is the right trigger

GPS tells you a phone is near the shop. Face recognition tells you who's in front of the camera. Neither tells you whether the phone clocking in belongs to the person it's clocking in for.

DailyBrew runs two device mechanisms in parallel. Device verification is the active one: within a single day, only one device per employee, and the check-out device has to match the check-in device. That blocks live buddy-punching attempts. The new-device alert — what this post is about — is the passive companion. It looks across the employee's full history of phones they've ever clocked in with, and pings you when one shows up that isn't in that history. It doesn't block; it just surfaces. That separation matters: the active check stops same-day fraud, the history check catches the slow drift (the staff member who quietly started using a different phone three weeks ago).

One thing the alert is not: a ping every time someone clocks in. Subsequent uses of a phone we've already seen for that employee are silent — the message isn't "Lyhour clocked in", it's "Lyhour clocked in on a phone we've never seen before for her." If she upgrades her iPhone tomorrow, you get one alert; then the new iPhone joins her known-devices list and the next 200 punches from it are quiet. If you want every clock-in to ping you, that's a different feature — live check-in alerts — controlled by its own toggle.

What an alert looks like

⚠️ New device used Lyhour Huy checked in from a new device. Device: iPhone 17 Pro Time: Apr 10, 09:00

You get one push, one Telegram message, one email — for the same event. Not three separate decisions to make, just three places the same fact can reach you.

When it's nothing — and when it isn't

  • Likely fine: the staff member upgraded phones over the weekend. New iPhone, same person. You reset their device binding in two taps (Console → Employees → Reset device) and the new phone becomes the baseline.
  • Worth a look: the alert lands during a shift you didn't expect anyone new to start. Or the device label reads "Android" for a barista who's been on iPhone for two years. Or the alert lands twice in one morning for two different people.
  • The buddy-punching tell: the new device is the same across two employees, two days in a row. That's the shared phone in the back room — and it's exactly the kind of pattern a normal time-clock report would hide.

Why we added email too

Push notifications get muted. Telegram chats get archived. The morning-rush owner who's elbow-deep in milk steamers doesn't read either until the rush is over — and by then the alert is buried under a hundred other notifications.

Email is the durable record. You can search it weeks later, share it with a manager, forward it to your accountant if it turns into a wage dispute. The three channels aren't redundancy — they're three different time horizons.

What this isn't

This isn't biometric. It isn't location tracking. It isn't a black-box "trust score." It's a single boolean: have we seen this device on this employee before? When the answer is no for the first time, we tell you. That's the whole feature.

Available on Espresso and Double Espresso, on by default. No setting to enable — the moment a workspace has a paid plan and a baseline device on file, the detector starts watching.

Read the three-factor explainer for the verification stack behind the alert, or check pricing to see what else Espresso unlocks.