Three kinds of cheating, three kinds of check
Scroll the table sideways to read all columns.
| Problem | What Attendify checks |
|---|---|
| Buddy punching: someone else clocks in | Liveness selfie on every punch, optional face verification, reused selfies refused |
| Fake location | Mock-location detection on the phone, plus location checks on the server |
| Tampered phone | Emulator, hooking tools, root or jailbreak, developer mode and debugger detection |
Checks on the phone
On app version 1.0.19 and later, the worker app checks the device at the moment of the punch:
- a mock-location (fake GPS) app supplying the location
- an emulator instead of a real phone
- hooking tools that alter how apps behave
- a rooted Android phone or a jailbroken iPhone
- developer mode, USB debugging (Android only) or an attached debugger
The results are stored with the punch, so a punch saved offline carries its evidence with it and is judged when it syncs.
Checks on the server, for every app version
The server runs checks no phone can skip:
- the exact same GPS fix repeated 30 or more minutes apart
- travel between punches faster than 250 km/h
- reported accuracy under 1 metre, which real phones rarely produce
- reported accuracy worse than 150 metres
- a selfie byte-for-byte identical to one already used anywhere in your company, which is refused outright
You decide: block, flag or allow
Each signal can be set to block, flag or allow under Settings → Security. Blocked punches are refused, and the phone refuses before the camera opens where it can. Flagged punches are accepted and land in the review inbox, so honest workers aren't stopped by a false alarm.
Scroll the table sideways to read all columns.
| Default | Signals |
|---|---|
| Block | Mock location, emulator, hooking tools |
| Flag | Rooted or jailbroken, developer mode, debugger, failed checks, all four GPS checks |
| Allow | USB debugging, debug builds, app versions older than 1.0.19 |
Once your workers have updated, switch older app versions to block so every punch carries device evidence.
What these checks can't prove
Device signals are reported by the app. A determined attacker with a modified app could suppress them. The server checks catch some of that, but not all. Attendify doesn't yet use Google Play Integrity or Apple App Attest to prove the app itself is genuine. Treat a clean punch as strong evidence, not proof, and keep a review process for disputes.