Fake GPS apps and attendance: how they work and how to catch them
5 November 2026
A fake GPS app makes an Android phone report a location of the user's choice. For attendance this means an employee can sit at home while the app says they are at the office gate. These apps are free, take a minute to set up, and are the most common way location-based attendance is cheated.
How mock location works
Android has a developer feature called mock location. It exists so app developers can test maps and navigation without travelling. A user turns on Developer options, picks a "mock location app", and that app then feeds any coordinates it likes to every other app on the phone.
To a simple attendance app, the fake position looks exactly like a real one. If the only check is "is the phone inside the office radius?", the punch passes.
Signals that expose a fake location
No single signal is perfect, so good attendance systems combine several.
The mock-location flag
When a location comes from a mock provider, Android marks it as mocked. An attendance app can read this flag and send it with the punch. This catches most off-the-shelf fake GPS apps.
App integrity
Some cheats go further and modify the attendance app itself, or run it on a rooted phone or an emulator that hides the mock flag. Google's Play Integrity check lets the server confirm the request came from the genuine app on a genuine, unmodified Android device.
Accuracy and consistency
Real GPS fixes have an accuracy radius that changes as you move, and they drift slightly indoors. Fake fixes are often perfectly still, or suspiciously accurate. A location with very poor accuracy shouldn't count as "inside the geofence" at all; set a maximum accepted accuracy.
The face at the punch
Location answers "where", not "who". Pairing every punch with a live face check means that even if the location were faked, the person would still have to be the employee, live, at that moment.
What to do when a punch is flagged
Treat a mock-location flag differently from an ordinary geofence miss:
| Situation | Likely cause | Action |
|---|---|---|
| Mock location detected | Fake GPS app | Block the punch |
| Integrity check failed | Modified app, rooted phone or emulator | Block the punch |
| Outside geofence by a little | GPS drift indoors | Send to HR for review |
| Outside geofence by a lot | Wrong place | Block, or review for field staff |
| Poor accuracy | Weak GPS signal | Ask the employee to step outside and retry |
Tell employees what is checked. Most people stop trying once they know a fake location is detected and recorded, and you avoid accusing anyone over ordinary GPS drift.
Why a geofence alone isn't enough
A geofence is only as trustworthy as the location the phone reports. Without the mock flag, an integrity check and a face check, it is a fence with an open gate.
PunchMe sends the mock-location flag and a Play Integrity verdict with every punch, matches the face on the server and lets you choose block or review for each case. See all the checks.