NFC attendance: what a tap actually proves

Published September 1, 2026

The morning rush is the worst possible moment to ask somebody for six seconds. Phone out, unlock, find the app, open the scanner, hold it steady over a laminated square by the till, wait for the frame to catch. It works. It is also the slowest part of a shift that has not started yet.

An NFC tag replaces all of that with one movement. It is a sticker the size of a coin, with no battery and nothing to pair — it wakes on the current from the phone held against it, hands over one piece of information, and goes back to sleep.

A tap is faster than a scan. It is not safer than one, and the difference is worth understanding before you stick anything to a wall. Here is what is actually on the tag.

What is actually on the tag

One web address, and nothing else. The tag holds https://dailybrew.work/checkin/… followed by your workspace's check-in token — the same token your QR code already carries, in a different envelope. Scan the square or tap the sticker and the server receives the same string.

There is no key on the tag, no signature, and no identity. It does not know who you are, and it is not encrypted, because there is nothing on it worth encrypting: it is a shortcut to a page, not a credential.

The hardware is deliberately dull. An NTAG213 sticker costs about thirty cents, holds a few hundred bytes, has no battery and no moving parts, and will comfortably outlast the counter you stick it to.

What happens when somebody taps

The tag opens the app. The address on it is registered as a link that belongs to DailyBrew, so the phone hands it straight to the app rather than to a browser. An iPhone XS or newer reads the tag with the screen locked and shows a banner; older iPhones need the app open first; Android reads it whenever the screen is on.

From there the punch travels the same road as a QR scan — the same endpoint, the same request, with one extra field saying it arrived by tag.

And it meets the same checks in the same order: your exemptions, the cooldown, the duplicate-punch floor, the IP restriction, the geofence, closures, approved leave, and device verification.

A tap is not a shortcut around any of it. Somebody who cannot clock in from their sofa with the QR code cannot clock in from their sofa with a tag either. The gesture changed. Nothing else did.

What a tap actually proves

It proves that a phone came within a few centimetres of that particular sticker. That is the whole claim.

It does not prove who was holding the phone. It does not prove the person is on shift, or awake, or anywhere near the pass. And it does not prove the sticker is the one you put there — a tag is readable by anyone who walks past with a phone, and the address on it can be written onto another tag in about four seconds.

So it is worth being blunt about this, because the industry generally is not: NFC is not an anti-fraud feature. It is a faster way to start a punch. Anyone selling you a tag as the thing that stops buddy punching is selling you a sticker.

What actually stops the buddy punch

The same three questions, whichever gesture started the punch.

Is this the shop's network? IP restriction refuses a punch from anywhere but the connection at your address. Is this the shop's doorstep? Geofencing checks the coordinates against a radius you drew on a map. Is this the same phone as last time? Device verification refuses a check-in from a handset that has already clocked somebody else in today.

Three-factor attendance covers how those combine and why no one of them is enough alone. The point here is narrower: they are the floor, they run identically for a tag and for a QR code, and the tag does not raise them.

The double tap, and why NFC gets its own cooldown

A tag read happens with your eyes somewhere else. You hold the phone against the sticker, you do not necessarily watch the screen, and two things go wrong routinely: the phone fires the read twice, or the person is not sure it worked and presents the phone again.

Either way the second read is a second punch — and a second punch on an open row is a check-out. Somebody who has just clocked in gets clocked straight back out, and nobody notices until the timesheet does.

So NFC punches carry a cooldown of their own. By default a tap within fifteen minutes of your last punch is ignored — silently, with no error and no second row. It is measured from whichever punch came last, so it also stops a re-check-in moments after a check-out. Anywhere from zero to a hundred and twenty minutes, set per workspace in Settings.

That is a different guard from the sixty-second floor, which protects every punch regardless of source and only ever suppresses a check-out on a row opened moments earlier — the case where a slow request makes it look like nothing happened and the user tries again.

The consequence is worth stating plainly: at the default, somebody who clocks in for a ten-minute errand cannot clock back out with the tag. If your shifts are genuinely that short, set the cooldown to zero and let the sixty-second floor do the work.

Where the tag comes from

You write it yourself, and it takes about a minute. The console hands you the address to copy — on the dashboard beside the QR code, and on each sub-QR's own page if you run more than one. Any tag-writing app does the rest; NFC Tools and NXP TagWriter are both free.

Write it as a URL record onto an NTAG213, then lock the tag read-only. Locking stops somebody overwriting your address with theirs. It does not stop anybody copying yours onto a blank — see above, and then stop worrying about it, because the network and location checks were carrying that weight all along.

One trap. Regenerating your workspace's check-in token invalidates every printed QR code and every programmed sticker at once. That is exactly what you want if a token has leaked, and a bad surprise if you were only tidying up. Rewriting the tags is that same minute, times however many you put up.

What it needs

The DailyBrew app on the employee's phone. A browser cannot read an NFC tag, so this is the one part of check-in that mobile web does not cover. The tag opens the app; if the app is not installed, the phone falls back to the web check-in page and the punch is an ordinary one.

Espresso. NFC check-in belongs to the Espresso plan. It is off by default — turn it on in Settings, under Check-in.

The QR code never goes away. There is no NFC-only mode and nothing to migrate. One token answers both, so the same person can tap the sticker in the morning and scan the square in the evening, and somebody on a phone with no NFC at all is locked out of nothing.

The short version: an NFC tag is a faster way to start a punch, not a stronger one. It holds a public address, it proves a phone touched a sticker, and every question that decides whether the punch counts — your network, your location, the device — is asked exactly as it is for a QR scan. Buy the tag for the six seconds it saves at the pass. Keep the verification for everything else.