What GPS attendance can prove, and what it cannot

What the phone actually sends

An app asks the operating system for a location and gets back a coordinate and an accuracy radius. Both come from the device. On Android, a developer-options setting lets any app supply a location of its choosing, and apps that do this are a search away. The coordinate is a claim, and treating it as proof is the mistake that makes everyone distrust the whole system.

Stacking signals

One signal is weak; several that have to agree are not:

• A bound device. The punch has to come from the handset registered to that employee, and swapping it needs approval.
• The office wifi. Being on the network is harder to fake from home than a coordinate is.
• A code that changes. A QR on a screen at reception that rotates every few seconds cannot be screenshotted and sent to a colleague.
• A face. Matched against a photo registered in advance.

Which of these must hold is a policy decision per site, and it is reasonable for a branch with a reception desk to be stricter than a field team.

Why not just block it

Because the false positives are not rare. A rebuilt phone, a bad GPS fix indoors, a clock that drifted — all of these look like cheating and none of them are. Blocking the punch means an honest person cannot start work, which is a worse failure than a dishonest one getting through.

The alternative is a queue. The punch is accepted, flagged with what looked wrong, and a human looks at the photo and records a decision. The record is what survives the argument in month three.

Reading it back

Whatever you build, the number that reaches payroll has to be traceable to the punch it came from, and the punch has to carry the evidence that was used to judge it. Our HR system keeps both.