Geofencing and mock location: why a punch gets refused
GPS radius, device binding and mock-location detection — the three checks behind an attendance record, and when each of them fires.
Any system where "I have arrived" can be tapped from anywhere is not recording attendance. It is recording that a button was pressed. The difference shows up at month end.
The radius comes from the branch itself
Each branch has coordinates and a radius, and a gate with its own circle takes precedence over the branch. The location the phone reports is compared against that circle, and the distance is kept next to the record as evidence.
A coordinate with no accuracy is not a check
If the phone reports its position with worse than about 100 metres of accuracy, the engine refuses the punch. Running a geofence test against a reading like that is theatre, not verification.
- Mock-location apps on Android are flagged on the record itself
- Server time is authoritative — a device clock can be changed
- An out-of-radius punch is not deleted; it goes to an admin for approval