An app should use location evidence as one input to a business rule, weighed with how trustworthy that evidence is, never as a fact on its own. Otukan supplies the trust part. It detects mock location providers on Android, software-simulated positions on iOS, and the hooking frameworks, emulators and modified systems used to fake a position, and it reports each indicator separately from the coordinates. Your backend compares them with network and account context and decides. Otukan does not claim to know where a person is, and it sends integrity indicators rather than a movement history.
Signal quality
Different kinds of location evidence fail in different ways. Keeping them apart is what stops an honest traveller from looking like a fraudster.
Mock locations
The simplest spoof replaces the position the operating system hands to apps. On Android, a user can nominate a mock location app in developer options, and positions from it can be recognised. On iOS, the system can mark a position as simulated by software. Otukan reads the signal each platform provides and adds its own checks for hooks that rewrite coordinates inside your app, which neither platform flag covers.
Network routing
The IP address of a request suggests where it came from, but VPNs, carrier gateways and roaming all move that point for legitimate reasons. Otukan reports proxy and VPN use as its own indicator. Comparing network origin with device position is a job for your backend, which also sees account history.
Sensor context
Movement, altitude and the rate at which positions change can show when a route is being played back. These are useful for your backend models, but they are noisy on real devices. Treat them as supporting context and let the integrity indicators carry the weight.
| Evidence | Tells you | Common honest cause of doubt |
|---|---|---|
| Mock provider or simulated flag | The position was supplied by software | Developers and testers |
| Hooking or emulator indicator | The environment can rewrite positions | Internal QA builds |
| Proxy or VPN indicator | Network origin may not match the device | Corporate VPN, travel, roaming |
| Sensor context | Movement pattern looks unusual | Indoor drift, weak satellite fix |
Use cases
Location risk earns its place only where a rule depends on it. Name the rule first, then decide how much doubt it tolerates.
| Business rule | Why spoofing pays | Starting response |
|---|---|---|
| Regional licence for betting or streaming | Access outside the licensed area | Hold the action on strong manipulation evidence |
| Location-based rewards or promotions | Collect rewards without visiting | Refuse the reward, keep the account |
| Delivery or field-work check-in | Paid for visits that never happened | Ask for a second confirmation |
| Payment risk scoring | Mask the origin of a fraudulent payment | Add weight to the risk score |
Write the rule down with its justification: what loss it prevents, which evidence it uses and what an honest user can do when the evidence is doubtful. A rule that cannot state its purpose usually collects more data than it needs and frustrates more customers than it protects. Otukan’s indicators then slot into that rule as one weighted input.
The same app can apply a strict response to one rule and a light one to another. Otukan sets responses per flow, so a doubtful check-in does not block a customer from reading their balance.
Privacy
Location is personal data, and the controls around it should be written down before launch.
Collection
Your app already asks for location permission; Otukan does not add a new request. It inspects the position at the moment your flow uses it and reports indicators about that position.
Retention
Otukan does not build a trail of where a user has been. Which indicators leave the device, what they are used for and how long your systems keep them is agreed with your privacy team during the technical review.
Legitimate travel
A person abroad on holiday, on a train crossing a border or connected through their employer’s VPN should not be treated as a suspect. Keeping routing indicators apart from spoofing indicators, and starting in observe mode, lets you see how genuine travel looks in your own data before a rule is enforced.
Location integrity is covered on mobile fraud prevention with the other fraud controls. An evaluation checklist is in the location integrity solution guide. For incident location in insurance claims, see insurance application security.