Consulting

Your app believes the phone. It should not have to.

If a coordinate from a device decides something in your product, we help you find out what a faked one looks like, and what to do about it.

Start a conversation How it works
Driver actually therePOST /v2/shift/clock-in
{
  "lat":          40.74128,
  "lng":         -73.98979,
  "accuracy_m":   5,
  "provider":     "gps",
  "is_mocked":    false,
  "captured_at":  "2026-08-27T14:02:11Z"
}
Driver at homePOST /v2/shift/clock-in
{
  "lat":          40.74128,
  "lng":         -73.98979,
  "accuracy_m":   5,
  "provider":     "gps",
  "is_mocked":    false,
  "captured_at":  "2026-08-27T14:02:11Z"
}
Byte for byte identical. Only one of them happened.

On iOS there is no mock-provider flag to catch the second one. The position is not injected around CoreLocation, it is injected underneath it, and the operating system believes it too.

If a location decides something, this is your problem.

Not a location you display. A location you act on.

Work and payroll

Shifts, deliveries, site check-ins. Money moves because a phone said where it was.

Games and rewards

Anything with a map in it, and anything that pays out for being somewhere.

Trust and safety

Dating, marketplaces, social. Distance is the first thing a stranger is judged on.

Risk and compliance

Geofenced features, regional licensing, telematics, fraud scoring on a coordinate.

Three weeks, three answers.

We build the tooling that does this. So we test your product the way somebody determined to beat it would, and then we tell you how to see it coming.

1

Break it

Your app, our tools, real hardware. Every place a faked location gets through, written down with the request that did it.

2

Show you the tell

What a spoofed device does differently, on the wire and over time, and which of those signals you can actually collect.

3

Leave you the harness

A test suite that reproduces every finding, so the next release cannot quietly undo the fix.

What we look at

None of these is proof on its own. Together they are a score you can act on without throwing out your best customer for having a bad signal.

  • Motion that does not match the map
  • Altitude, heading and speed consistency
  • Accuracy that never varies
  • Wi-Fi and cell towers against the claim
  • Timing, jitter and sample cadence
  • Device posture and integrity attestation
  • Route shape versus real road geometry
  • What the same account did yesterday

We are on the other side of this every day.

PinDrift is a location changer with paying customers. That is an uncomfortable thing to put on a consulting page, and it is the reason the advice is worth anything: we are not reading about the attack, we are maintaining it. We do not sell a detection product, so there is nothing here we are steering you towards.

Tell us what you are protecting

What you have tried, and what a good outcome would look like. A few sentences is plenty for a first message. We come back with questions, or with the shape of an engagement, before anything is quoted. If it is easier, write to [email protected] instead and it reaches the same people.

Email us

Write to [email protected] with what you are building and what you are worried about. We answer in one to three working days.