How do apps detect mock or fake GPS locations on Android and iOS

Definition

How do apps detect mock or fake GPS locations on Android and iOS?

Both platforms expose a flag for simulated locations, Location.isMock() on Android and isSimulatedBySoftware on iOS, but each only covers the platform’s own simulation paths, so apps that need real locations add device integrity checks and cross-signal consistency on top.

Android

Android lets a user choose a mock-location app in developer options. Locations it supplies are marked, and apps can read the mark with Location.isMock(), added in API level 31. It replaces isFromMockProvider(), available since API level 18 and now deprecated (Android reference).

The flag covers only locations that pass through the framework’s test provider. A rooted device or a hooking framework can hand an app a location without the mark.

iOS

Since iOS 15, each CLLocation can carry source information. isSimulatedBySoftware is true when “the system generated the location using on-device software simulation,” such as a GPX file loaded in the Xcode debugger (Apple documentation). isProducedByAccessory marks locations from an external GPS accessory or CarPlay.

An Apple engineer has described the limit. Asked why the flag missed a third-party spoofing tool, the reply was that such a tool “will not have access to set that API flag” (Apple Developer Forums).

The platform flags catch only locations the platform itself simulated.

What apps add on top

Integrity checks for root, jailbreak, emulators and hooking frameworks. See device integrity checking.
Platform attestation that the app is unmodified and the device genuine. It says nothing about location by itself. See do App Attest and Play Integrity verify location?
Cross-signal consistency. A spoofed GPS fix rarely agrees with the Wi-Fi networks and cell towers the device can see, or with its motion sensors.
Signing in hardware. Octet builds a statistical proof from hundreds of on-device inputs, evaluates the location on the device, and signs the verdict with a key in the Secure Enclave or StrongBox, so a hooked app cannot produce a valid proof. See device-attested location.