What the tools actually do
Android has long had a developer setting that lets a nominated app supply location to the rest of the system. It exists for legitimate testing. In practice it means any app reading location, including a workforce tracker, receives the coordinates the mock app is publishing rather than the ones the receiver computed.
The tracking app is not being hacked. It is being told a lie by the operating system it is entitled to trust, and it can read a flag that says so.
What it corrupts
Every derived number, which is the point. A faked position inside a site boundary produces an attendance record for a place nobody attended. A faked trail produces distance, and distance becomes a mileage claim in real money. A faked position near a job makes somebody appear to be the nearest available worker. If a geofence controls whether a clock-in is permitted, faking the position defeats the control entirely.
The uncomfortable part is that these records look normal. They are not malformed or obviously wrong. They are clean rows that happen to be false, sitting alongside true ones, and by the time an invoice is queried nobody can tell them apart.
Why geofencing is not an answer
Restricting clock-ins to inside a boundary is the standard control, and it addresses a different problem. It stops somebody clocking in from home who is not pretending to be elsewhere. Against a spoofed position, a geofence is not just ineffective, it is counterproductive: the faked reading satisfies the check, so the system's own control now vouches for the false record.
The same goes for identity checks. A selfie or a face match confirms who is holding the phone. It says nothing about where the phone claims to be.
Detection is the easy part
Mobile platforms expose whether a reading came from a mock provider. There are also readings that are not flagged but are physically impossible, most obviously two positions implying a speed no vehicle achieved. Both are detectable without anything clever.
So the interesting question is not whether a product can detect this. It is what the product does next.
Why deleting the reading is the wrong fix
The instinct is to throw the bad reading away, and it produces a tidier dataset and a weaker record.
A record with silent deletions cannot be defended. The first move of anyone contesting it is to ask what was removed, and "the system dropped anything it disliked" is not a reassuring answer. Worse, a gap is ambiguous: a missing hour looks the same whether the phone was off, out of signal, or lying. You have destroyed the distinction that mattered.
There is a management cost too. Deleted readings mean nobody ever learns that a particular phone reports faked positions three times a week, because the evidence is thrown away each time. A pattern is more useful than any single reading.
Keep it, mark it, exclude it, show it
The approach that survives contact with a dispute has four parts. Keep the reading. Mark it as reported-fake. Exclude it from everything derived, so it never contributes to a visit, an hours total or a mileage claim. And show it, including in what you send a customer.
That last part feels wrong and is the most valuable. A day report that shows forty-one readings in a window, zero of them trusted, the phone reporting a mock location, and the nearest trusted reading 2.8 km away, is a far stronger document than one that shows a tidy blank. It demonstrates the system is not curating in your favour, which is exactly the doubt a customer arrives with.
What to ask
Three questions, and the wording matters because "spoofing prevention" in this market often refers to face spoofing, someone holding a photograph to the camera, which is a different problem.
- Do you detect readings supplied by a mock-location provider, and can I see them?
- When you find one, is it deleted, or kept and marked?
- Does a flagged reading still count toward hours, visits or mileage totals?
If the answers are yes, kept, and no, the numbers coming out are worth something. Otherwise mileage is a self-reported figure with extra steps.
Questions
Can an employee fake their GPS location?
Yes. Mock-location apps are freely available and take a few minutes to set up. The tracking app receives the coordinates the mock provider publishes, along with a flag indicating the reading came from one.
Does geofencing stop location spoofing?
No. A geofence checks whether the reported position is inside a boundary, and a spoofed position satisfies that check, so the control ends up endorsing the false record. Face recognition does not help either: it confirms who holds the phone, not where it is.
Should faked readings be deleted?
No. Keep them, mark them, and exclude them from anything derived. A record with invisible deletions cannot be defended when it is questioned, and a gap does not distinguish a switched-off phone from a lying one.
Does a flagged reading affect a mileage claim?
It should not. In our system flagged readings are excluded from the distance entirely, so a faked position cannot inflate a claim, while the reading itself stays visible in the record.
Where this shows up in the product