What is location spoofing, and how is it detected

Definition

What is location spoofing, and how is it detected?

Location spoofing is making a device or a request appear to be somewhere it is not, by changing what the network shows (a VPN or proxy) or what the device reports (fake GPS, an emulator, a modified app), and it is detected by looking for those tools and for signals that disagree.

Two kinds of spoofing

Network spoofing changes where traffic appears to come from. VPNs, proxies and residential-IP services all do this. It defeats checks based on IP address and does nothing to the device’s own sensors. See VPN, proxy, residential IP and Private Relay.
Device spoofing changes what the device itself reports. Mock-location apps, emulators, rooted or jailbroken phones, hooking frameworks and radio GPS spoofers all fall here. It defeats checks that trust the device’s location without checking how it was produced.

How it is detected

Looking for the tools. Known VPN and data-centre addresses, mock-location settings, emulator fingerprints, root and jailbreak markers. This catches what is known. See device integrity checking.
Looking for disagreement. A GPS fix in Ohio with Wi-Fi networks seen in Kentucky, a phone that “moves” fifty miles in a second, satellite signals that are all the same strength. A consistent fiction across many independent signals is much harder to maintain than one fake value.
Taking the software out of the loop. If the result is signed by a key in secure hardware and the platform certifies the app is unmodified, a hooked or modified app cannot produce a valid result. See device-attested location.

No location-spoofing method seen to date fakes every signal so that they agree with each other over space and time, on a device the platform still certifies.

What detection cannot stop

A person who is genuinely in the right place can act for someone who is not, using a real phone. This is not spoofing, because the location is true. It needs one person in place per account, so it does not scale the way a VPN subscription does.

What this does not establish

A verdict answers for a device, not a person. It says an enrolled device was inside or outside a region at a time. It does not say who was holding it. Use it alongside identity verification, never instead of it. It does raise the cost of cheating: instead of a VPN subscription, a cheater needs real devices and a person in the permitted place for every transaction.