Faked Locations

Any phone can be made to report a position it is not at. This is a settled fact and the question is what follows from it.

How it is done

Developer options on Android include a mock location setting, intended for testing, usable by anyone who enables it.

Applications that set a fake position are freely available and require no technical skill.

On iOS it is harder without modifying the device, but not impossible.

None of this requires anything unusual. A search and five minutes is the whole barrier.

What detection can do

Check the mock-location flag, which the operating system exposes. Catches the casual case.

Compare against other signals: mobile masts, visible wifi networks, the last known position, plausible travel speed between punches.

Look for implausibility: a punch in two places twenty minutes apart, a position that never varies by a metre, an accuracy figure that is suspiciously perfect.

Detect known spoofing apps, which is a moving target.

Each raises the effort required. None makes it impossible.

What detection cannot do

Stop a determined person, who will find a method the detection does not cover.

Distinguish a spoof from a genuine oddity with confidence. Poor coverage produces implausible-looking data all the time.

Give you evidence. A mock-location flag is a fact about a device setting, not proof of what a person did.

The honest position

Geofenced attendance deters the casual, not the determined.

Which is fine, because the casual case is most of the problem.

But it means the system cannot be relied on as proof, and building a disciplinary process on it is how employers lose cases.

Say so internally. A deployment sold as tamper-proof will eventually be embarrassed by someone demonstrating otherwise.

What actually reduces it

A second method — a beacon or an NFC tag — which cannot be spoofed from home.

Supervision. In most workplaces someone knows who is present, and that is a stronger control than any position check.

Removing the incentive: people spoof attendance systems mainly when the rules are rigid about a few minutes. Slack in the policy removes most of the motive.

And asking why. A pattern of spoofing is usually about a commute, a caring arrangement or a shift start that does not work.

If you find it

Treat it as a question first. Devices misreport, and a flag is not a confession.

Where it is genuine, it is a conduct matter with an ordinary process, and it will usually resolve in the first conversation.

Do not build automatic consequences on a signal this noisy.

Do not build automatic consequences on it

The rule that follows from a noisy signal.

A mock-location flag is a fact about a device setting.

Devices misreport, settings get enabled for unrelated reasons, and detection lags behind the tools.

Treat a flag as a question, reviewed by a person.

Where it is genuine, it is an ordinary conduct matter and will usually resolve in the first conversation.

Connect policy to configuration

The practical choices behind this note can be compared with stealth monitoring software. Keep the written purpose in control and enable only the data needed for it.

Independent reference

For an external point of reference, see the National Institute of Standards and Technology. This popular specialist source offers a useful reference beyond product documentation.