How to Prevent GPS Spoofing on a Time Clock

You can’t make a phone’s GPS impossible to fake, but you can make faking it pointless. The way to do that is to stop trusting GPS alone: pair it with a second proof of presence (a photo, a Wi-Fi or kiosk check), let the software flag impossible patterns, and have a manager review exceptions every pay period. This guide covers how location spoofing actually works on a phone, what a small business can do about it, and what the law says you still owe your employees when a system gets fooled.

TL;DR

• Spoofing a phone is usually a fake-location app, not a radio device. Software on the phone tells every app the wrong coordinates.
• GPS alone is a single signal. Layer it with photo verification, a shared kiosk, Wi-Fi or IP checks, and audit rules.
• Never buy or use a GPS jammer. It is illegal under federal law, with penalties that can reach $112,500 per violation.
• Under the FLSA, you stay responsible for accurate records even if a system is spoofed. Geofencing is audit support, not a substitute for management.
• Tell employees what you collect and why, before you turn any of this on.

Table of Contents

• Two kinds of “spoofing” that get mixed up
• Why a single GPS reading is easy to fool
• Build layers: what to check besides GPS
• What to do about jammers
• A sensible audit routine for small teams
• What the law still expects from you
• Our perspective: make cheating boring, not impossible
• Put the checks in one place
• Where each check helps
• FAQ
• Sources

Two kinds of “spoofing” that get mixed up

Search for this topic and most of what you find is about satellites: engineers protecting timeservers, aviation systems and power grids from fake signals. That is real, but it is not the problem a restaurant, a job site or a clinic has.

Signal spoofing means broadcasting counterfeit satellite signals so a receiver computes the wrong position or time. The Android developer documentation describes jamming and spoofing as the two categories of GNSS interference: jamming drowns out the weak satellite signal, while spoofing feeds the receiver false data. It takes specialized equipment, and it is rare in a workplace.

Location spoofing is far more common and far cheaper. It happens when a device reports a falsified location, which can be done with spoofing apps, mobile emulators, modified app builds, or VPNs and proxies. On Android, the usual route is turning on developer options and choosing a mock-location app. The operating system then hands the fake coordinates to every app on the phone, including your time clock.

This article is about the second kind, because that is what an employee clocking in from the couch is doing. It also touches the first, because the same principle protects against both.

Why a single GPS reading is easy to fool

A standard smartphone receiver usually cannot tell a genuine satellite signal from a convincing fake. Researchers have worked on detection for phones, but it remains limited. A 2022 paper in the Institute of Navigation’s journal notes that location engines on Android devices have had very limited protection from these threats.

The techniques that do exist are mostly technical:

• Checking automatic gain control and carrier-to-noise metrics for abnormal patterns, such as signal strength rising while gain drops. Android’s developer guidance covers this.
• Comparing GPS-reported time with network-synchronized time. A large gap is a possible spoofing indicator, according to the same page.
• Looking for discontinuities in signal history, which can reveal a re-radiator replaying signals from somewhere else, as described in CISA’s guidance on GPS equipment used by critical infrastructure.

None of that is something a shop owner configures. What matters for you is the principle underneath it. A critical-infrastructure engineering write-up puts it plainly: reliable detection comes from comparing GPS observations against independent sources. The business version of that idea is to never let one signal decide whether someone was at work.

Build layers: what to check besides GPS

Federal cybersecurity guidance points the same direction. CISA’s positioning, navigation and timing resources recommend diversifying sources rather than relying on GPS alone. Translated to a time clock, that gives you a stack of checks, each cheap on its own and awkward to defeat together.

1. Geofence the location

A geofence is a virtual boundary around your site. A punch outside it is blocked or flagged. It stops honest mistakes and lazy cheating, such as clocking in from the parking lot across the road or from home. If you want the mechanics, our explainer on what geofencing is for time clocks walks through radius, accuracy and edge cases, and our GPS employee time tracking guide covers how GPS punching works in general.

A geofence is the layer a spoofing app defeats directly, because the fake coordinates simply land inside the boundary. That is why it can’t be the only layer.

2. Require a photo at the moment of the punch

A photo taken at clock-in answers a question coordinates can’t: is the right person physically there, looking like they are at work? A fake-location app does nothing about a selfie of someone’s living room. Photo verification is built into Kloqk’s time clock, and the photo clock-in policy guide explains how to set expectations and privacy rules for it.

A caution on faces: if you ever move from photo capture to automated face matching, you enter biometric territory, where several states have specific rules. Read are biometric time clocks legal, state by state before you do.

3. Add a signal that isn’t GPS

This is the single strongest upgrade. Examples of independent signals:

• A shared kiosk. One tablet at the counter or on the job-site trailer, where people punch in front of coworkers. Nothing to spoof except being absent, and absence is visible.
• Wi-Fi or IP restrictions. Allowing punches only from your network’s public IP, or when the phone sees your site’s Wi-Fi, ties the punch to something a fake-location app can’t change. CISA’s guidance lists Wi-Fi proximity, IP restriction and kiosk authentication as ways to cut reliance on a single spoofable signal. Check which of these your own software supports before you count on them.
• A physical tracker in company equipment. If crews drive company trucks or move equipment, a hardware tracker reports location from its own receiver, not from the employee’s phone. A subscription-free option such as GPS trackers with geofencing and alerts for vehicles and equipment gives you a second, independent location record to compare with punches.

4. Let the data flag the impossible

You don’t need a data scientist. A few simple rules catch most automated or lazy spoofing. The engineering article above suggests flagging entries that imply impossible travel, such as speeds above 120 mph between check-ins, and several people checking in from the same coordinate that isn’t a known site. In plain business terms, look for:

• Someone punching at a site, then at another site 40 miles away eight minutes later.
• Three employees whose punches show identical coordinates to many decimal places, when the job site is a large lot and real readings would scatter.
• A punch location that is perfect every single day, with zero drift. Real GPS wobbles by a few yards.
• Punches from a location that doesn’t match the person’s schedule or assigned site.
• A sudden pattern: one person’s accuracy readings or punch times change the week after a new phone or app shows up.

None of these proves anything alone. Each is a reason for a two-minute conversation.

What to do about jammers

Some owners ask whether they should fight spoofing by blocking signals, or worry that employees will use jamming devices to hide from tracking. Don’t touch this yourself. The FCC says it is generally illegal, with few exceptions, to operate, market or sell jamming devices, and its enforcement page lists penalties of up to $112,500 per violation, equipment seizure and possible criminal sanctions. GPS.gov adds that there are no exemptions for use within a business.

If you suspect an employee is carrying a jammer, don’t confront them or try to counter it. Report it to the FCC Enforcement Bureau and keep your own records of the missing or blank location data.

A sensible audit routine for small teams

Technology makes the exceptions visible. A routine makes them matter. This one fits a manager’s week.

1. Each pay period, run the exception review. Filter for punches outside geofence, missing photos, edited entries and flagged locations. Ten minutes for a team of 15 is realistic.
2. Spot-check three punches per person. Compare the photo, the location and what you know about the day.
3. Ask before you assume. A phone with weak signal indoors produces odd readings. A basement walk-in cooler or a steel-framed building can throw GPS off, so a bad reading isn’t proof of cheating.
4. Fix with a record. If a punch is wrong, edit it with a note on who changed what and why. The Department of Labor’s recordkeeping page expects accurate records, and you should be able to show your changes.
5. Escalate through policy, not suspicion. Repeated, deliberate fake locations are a time-theft policy violation. Handle them as written in your handbook.

For teams spread over several sites, location rules get harder to keep consistent. Our guide on multi-location time tracking and back pay risk covers how to keep each site’s rules and reviews straight, and the audit-ready geofenced clock-in guide lays out a two-week rollout.

What the law still expects from you

Catching spoofers feels like a technology problem. Legally, it is mostly a recordkeeping one.

Under the FLSA, the employer is responsible for accurate time records. The Department of Labor’s Fact Sheet #21 says employers must keep payroll records for at least three years, and the records that wage calculations rely on, such as time cards, for at least two. In practice, that means a spoofed punch isn’t a defense for paying the wrong amount. If a system is fooled, you are still on the hook for paying all hours actually worked.

Two consequences follow:

• Don’t auto-trust, and don’t auto-deny. Commentary on Department of Labor guidance about automated systems warns that relying on software to bypass the duty to record all actual hours can lead to wage theft. If a geofence blocks a punch and the employee worked anyway, you must still pay for that time. Build a fast way for staff to submit corrections.
• Pay for the work, discipline the cheating separately. If someone faked a clock-in, you can address the conduct under your policy. You shouldn’t solve it by shaving hours they did work.

Our pieces on why job-site clock-ins prevent disputes and FLSA time rounding rules cover the rest of the pay-accuracy picture. This is general information, not legal advice. For a specific situation, such as disciplining an employee or a state-specific rule, talk to an employment attorney or your state labor department.

Be open about what you collect

Location and photo data are sensitive. A law-firm analysis of FTC enforcement says employers should be transparent about location tracking and biometric tools, and that monitoring without a clear business purpose raises scrutiny under Section 5 of the FTC Act. A simple, defensible approach:

• Write down why you collect location and photos (accurate pay, not general surveillance).
• Collect location only at the moment of the punch, not all day, unless the job truly requires it.
• Tell employees in writing, before launch, what is captured and who sees it.
• Limit access to managers who handle payroll.
• Keep data only as long as your recordkeeping duties require.

Our perspective: make cheating boring, not impossible

We build a time clock, so people expect us to say software can stop time theft. It can’t, entirely, and we’d rather tell you that than sell you a promise.

Here is what we have seen in how small teams work. A determined person with a fake-location app can beat a lone geofence. Most people aren’t determined. They are tempted by a bad commute, a forgotten punch or a coworker’s favor. Layered checks (a photo at the punch, a boundary around the site, a clean report of exceptions) remove the easy options, and when the easy options go, most of the behavior goes with them.

The second point is about what you do with the information. A flag is a question, not a verdict. Teams that treat every odd reading as theft end up with resentful staff and wrong payroll. Teams that look at the exception list weekly, talk to people and fix the record end up with accurate hours and trust.

That is why we keep the core time clock free for small businesses, including unlimited employees, overtime and break calculations, photo verification and payroll exports, with upgrades optional. Accurate hours shouldn’t depend on whether you can afford the extra tier.

Saad

Put the checks in one place

Kloqk’s time clock turns clock-ins into payroll-ready hours, and it includes photo verification, GPS geofencing, mobile and kiosk punching and a team dashboard for reviewing exceptions. You can see how geofenced punching works on our GPS time clock page and compare the Free, Pro and Premium plans on the pricing page. Pro is $29 per month per location and Premium is $59 per month per location, and the pricing page shows which features sit on each plan.

Where each check helps

The last row is the point. Tools make a manager’s attention efficient. They don’t replace it.

FAQ

How do I stop employees from faking their GPS location on a time clock?

Layer your checks. Pair the geofence with a photo at clock-in, add a signal that isn’t GPS such as a kiosk or network restriction, and review exceptions every pay period. A fake-location app can fool one signal but rarely all of them at once.

Is using a GPS spoofer illegal?

Faking your phone’s location with an app isn’t the same as jamming. Jamming devices are illegal to operate, sell or market under FCC rules. Faking a location to claim unworked hours, however, can break your workplace policy and may amount to fraud depending on the facts, so ask an employment attorney before taking formal action.

How can I tell if an employee’s GPS is being spoofed?

Look for patterns instead of single readings: impossible travel between punches, several people sharing identical coordinates, locations with no natural drift, or punches that don’t match photos and schedules. Phone-level detection exists but is still limited on standard smartphones, so cross-checking against independent evidence works better.

If an employee spoofs a clock-in, do I still have to pay them?

You have to pay for all hours actually worked. The FLSA places the recordkeeping duty on the employer, per the Department of Labor. Correct the record to match real hours, document the edit, and handle the faked punch as a conduct issue.

Sources

• FCC: Jammer Enforcement
• GPS.gov: Information About GPS Jamming
• Android Developers: Detect GNSS jamming and spoofing
• Detecting GNSS Jamming and Spoofing on Android Devices, NAVIGATION
• CISA: Improving the Operation and Development of GPS Equipment Used by Critical Infrastructure
• CISA: Positioning, Navigation and Timing
• Adaptive Query: GNSS Jamming and Spoofing Detection
• DATABASICS: GPS Spoofing Detection and Audit Guide
• U.S. Department of Labor: Fact Sheet #21, FLSA Recordkeeping
• National Law Review: DOL guidance on AI and the FLSA
• Conn Maciel Carey: FTC targets employers using worker surveillance technologies

Recommended

• How GPS Time Tracking Works for Employee Timesheets
• Why Job-Site Clock-Ins Prevent Disputes at Work
• What Is Geofencing for Time Clocks? How It Works
• The Role of Location-Based Timekeeping in Field Work