Catching Fake GPS in Delivery Apps

Any app that pays people based on location will eventually meet mock-location tools. They're free, they take a minute to set up, and they let a phone report coordinates from anywhere on Earth.

The good news: Android tells you when a fix is fake. Every location object carries a flag — isFromMockProvider (or isMock on newer APIs). If your location library forwards it, the client-side check is one line:

if (location.fromMockProvider) {
  // don't trust this fix
}

The interesting question is what to do next

Silently dropping fake fixes is tempting but wrong — the user keeps "working" while the system ignores them, and the eventual dispute is ugly.

What works better: a full-screen, unmissable block. The moment a fix arrives with the mock flag, the UI is replaced with an interstitial explaining that a fake-location app is active and work can't continue until it's turned off. Honest users with a forgotten developer setting fix it in seconds. Dishonest users know exactly why the app stopped paying attention to them — and that arguing is pointless.

A few hard-earned notes:

• Check every fix, not just the first. Spoofing tools can be toggled mid-shift. The check belongs in the location stream, not in the login flow.
• Client checks are the first line, not the last. A serious setup also sanity-checks server-side: impossible speeds, teleports between fixes, patterns that don't survive scrutiny. The boolean gets the easy 95%; the backend catches the creative 5%.
• Don't punish silently. Blocking with an explanation converts most cases instantly and creates a clean audit trail for the rest.

Anti-fraud enforced politely, at the point of use, beats a clever detection system nobody can explain to a support agent.