← Back to blog

1 August 2026 · 5 min read

How GPS Geofencing Attendance Works (And How to Stop Fake Location Punches)

GPS geofencing is the most common way attendance apps verify an employee was actually at the office when they punched in. It sounds simple — check if the phone's coordinates fall inside the office boundary — but a naive implementation is trivial to fool. Here's how it actually works when done properly.

Two ways to define an office boundary

Most systems support two boundary shapes. A radius boundary is the simplest: pick a center point (the office's latitude/longitude) and a distance in meters — anyone within that circle counts as "at the office." This works well for a single building with a compact, roughly circular property.

A polygon boundary lets you trace the exact shape of a property on a map instead of approximating it with a circle — useful for irregular campuses, factories with multiple buildings, or offices that share a boundary with an unrelated property next door where a simple radius would incorrectly include the neighbor.

Why GPS accuracy has to be part of the check

Phone GPS isn't exact — it comes with an accuracy radius (often 5–50 meters depending on the device, indoors vs. outdoors, and sky visibility) reported alongside every location reading. A geofence check that ignores this will randomly reject genuine employees standing at their desk simply because their phone reported a slightly-off coordinate that day.

The fix is to widen the effective boundary by the reported accuracy figure — but only up to a sensible cap (commonly 50–100 meters). Without a cap, an employee whose phone reports very poor accuracy (which can itself be a sign of a spoofing tool) could pass the check from much farther away than intended.

Catching fake-location apps

Android and iOS both let developers detect when a location reading came from a mock-location provider rather than real GPS hardware — a flag any properly built attendance app should read and log. On its own this doesn't have to block the punch outright (a false positive is possible), but it should always be flagged for a manager to review, and paired with a device-binding rule so the same employee can't punch from two different phones on the same day.

The most reliable systems treat geofencing as one signal among several — combined with identity verification (face recognition or phone biometric) and fraud flags reviewed by HR — rather than the single source of truth. A GPS coordinate proves where a phone was, not who was holding it.

See it running on your own team

First month free, unlimited employees. No credit card required.

See pricing →