If you are concerned about facial recognition being circumvented using photographs, you should consider the alternative, which is generally access cards. Both technologies provide a simple barrier to access so that only people who should have access can clock in and clock out, and also help you record who has clocked in/out and to examine this later by viewing an audit trail.
But neither technology is perfect: access cards are particularly problematic because they can be: