“Caught in the Act: Detecting Fake GPS Locations in Your Android App”

The Unexpected "Trip" of a Delivery Agent

It was a normal day at "SwiftDeliver," a booming delivery startup that prided itself on fast and reliable service. The app was built with real-time location tracking, ensuring that customers could track their orders accurately. However, one day, something strange happened.

A delivery agent, Alex, had just accepted an order in New York, but within seconds, his location updated—he was suddenly in Los Angeles! The system flagged this as impossible, yet Alex swore he never left the city.

What went wrong? A classic case of mock location abuse.

Understanding Mock Locations in Android

Android allows developers and testers to simulate GPS locations using mock providers. While this is useful for testing, it can be exploited by users who manipulate their GPS location using third-party apps. This can be a major problem for apps that rely on real-time location tracking, such as delivery services, ride-sharing platforms, and banking apps.

How to Detect Fake GPS Locations in Your Android App

Android provides two methods to check if a location is fake:

1. isMock() (Android 12+)

2. isFromMockProvider() (Deprecated in Android 12, used in older versions)

Key Differences

Here’s how to handle both cases to ensure compatibility across Android versions:

Code to Detect Mock Locations

import android.location.Location
import android.os.Build

fun isLocationMocked(location: Location): Boolean {
    return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
        location.isMock
    } else {
        location.isFromMockProvider
    }
}

Breaking It Down

• If the device is running Android 12+ (API 31), we use location.isMock, which is the recommended method.

• For older versions, we use location.isFromMockProvider(), which was deprecated in Android 12.

• This ensures your app remains compatible across all Android versions.

What to Do If a Mock Location Is Detected?

Simply detecting a mock location is not enough—you need to decide how your app should respond. Here are a few strategies:

1. Show a Warning Message

if (isLocationMocked(location)) {
    showToast("Mock locations are not allowed!")
}

2. Restrict App Features

For example, a ride-sharing app could prevent a user from booking a ride if a mock location is detected.

if (isLocationMocked(location)) {
    disableBookingButton()
}

3. Log the Event for Further Analysis

if (isLocationMocked(location)) {
    Log.w("LocationSecurity", "Mock location detected! User might be spoofing GPS.")
}

Nearby Topics: Enhancing Location Security

1. Enforcing Location Accuracy with LocationRequest.PRIORITY_HIGH_ACCURACY

To reduce location spoofing, always request high-accuracy GPS updates:

val locationRequest = LocationRequest.Builder(Priority.PRIORITY_HIGH_ACCURACY, 5000).build()

This ensures the device uses GPS, Wi-Fi, and mobile networks for the most precise location.

2. Verifying Location with Backend Checks

A more robust approach is to verify location changes on the server-side. If a user’s location suddenly jumps hundreds of miles in seconds, flag it as suspicious.

3. Blocking Developer Mode (Optional)

Many mock location apps require Developer Mode to be enabled. You can check this setting:

val isDevMode = Settings.Secure.getInt(
    contentResolver,
    Settings.Global.DEVELOPMENT_SETTINGS_ENABLED, 0
) != 0

If enabled, you can warn the user or restrict certain features.

Final Thoughts

Back at SwiftDeliver, after implementing these checks, Alex’s "teleportation" problem was solved. The app could now detect and prevent fake GPS locations, ensuring that all deliveries were legitimate.

By using isMock() and isFromMockProvider() smartly, you can protect your app from GPS spoofing and fraudulent activity, keeping your users safe and your business secure.

Are you ready to level up your app’s location security? Implement these checks today and stay ahead of GPS spoofers!