How fake GPS works
Android lets developers set a "mock location app" in Developer options, for testing. Dozens of free apps use this to feed the phone any location you pick on a map. An attendance app that simply reads the phone's location and checks it against the branch will accept it — the phone is lying, and the app has no second opinion.
The other common tricks are simpler: checking in from the parking lot next door when the radius is too large, or handing the phone to a colleague who is already at the branch.
Three layers that stop it
1. Refuse mock locations on the phone
Android marks a location that came from a mock provider. A good attendance app reads that flag and refuses the check-in outright, with a clear message, instead of quietly recording it.
2. Re-check the distance on the server
Never trust a "you are inside" answer computed on the phone. The phone should send its coordinates, and the server should measure the distance to the branch centre and decide. That way a modified app or a replayed request can't simply claim to be inside.
3. Prove it's the right person
Location tells you where the phone is, not who is holding it. A face check at check-in — with a blink to prove it's a live face and not a photo — closes the "friend checks in for me" gap. For shared-phone teams, a face kiosk at the entrance does the same job.
Set the work area sensibly
- Start at 100 metres. It covers a typical branch and its entrance without reaching the tea shop down the road.
- Go wider only where GPS drifts: inside large buildings, basements or dense markets, 150–200 m may be needed.
- Handle the exceptions explicitly: work-from-home days and staff who are exempt from the fence should be settings, not workarounds.
What the report should show
A refused check-in is evidence, not noise. Your daily attendance should show who was refused and why — "Refused · mock GPS" next to a name tells a manager far more than a missing entry.
How KYE HR does it
Each branch gets a work area (100 m by default). Mock-location apps are refused on the phone, the server re-checks the distance on every check-in, and the face check with blink matches the person to their registered face — registered once, with consent and admin approval. See how attendance works →