What is GPS spoofing?

GPS spoofing means two things. One is a radio transmitter broadcasting counterfeit satellite signals at every receiver in range, the other is software changing the coordinates a single phone reports about itself. They share a name and almost nothing else.

Search this term and you will find two categories of article that appear to contradict each other. One describes a serious security threat to aviation and shipping. The other describes an app that changes what your phone tells Life360. Both are using the same words, and they are not describing the same activity.

One: faking the satellites

GPS satellites broadcast timing signals, and the signal reaching your receiver is extremely faint by the time it has travelled from orbit. A transmitter on the ground can broadcast a stronger counterfeit signal that receivers accept in preference to the real one.

This works because the open civilian signal was never designed to prove who sent it. A receiver takes the timing data that arrives, does the arithmetic and reports a position, with nothing in the format to check the sender against. A close, strong, well formed lie beats a faint truth from orbit. Newer constellations have begun adding signal authentication, but the installed base in cars, ships, drones and phones was built for a system that assumes good faith.

Spoofing is worth separating from jamming, because reporting often merges the two. Jamming drowns the band, and a receiver that gets nothing knows it has nothing. Spoofing hands the receiver a plausible wrong answer, which it reports with complete confidence. Jamming is louder and easier to notice. Spoofing is the worse of the two, because the failure does not look like a failure.

This affects everything in range. Aircraft, ships, vehicles, phones, anybody who happens to be nearby and never consented. It is heavily regulated for exactly that reason, and reported incidents near conflict zones and busy airports are what most serious journalism on GPS spoofing is about.

It is not beyond noticing, either. Equipment built to look for it can compare where a signal physically arrives from using more than one antenna, check the satellite geometry against what should be overhead, and watch for the abrupt power jump a ground transmitter produces. Aviation and maritime receivers increasingly do some version of this. Consumer phones largely do not, and Apple does not document what, if anything, an iPhone checks.

This is not a phone app. It is a radio transmitter, and it is the version that genuinely deserves the alarmed tone.

Two: changing what one device reports

The other meaning is entirely local. No signal is broadcast. Nothing outside the device is affected. The phone simply reports different coordinates to the apps running on it.

On iPhone this uses Developer Mode, which Apple added in iOS 16, through the same developer pathway used to test an app against a location the developer cannot physically visit. Nothing is transmitted, nothing is jammed, and no other device is affected.

Mechanically it is unglamorous. A desktop tool talks to the phone over USB or the local network, or an app on the phone itself does, using the developer service Xcode uses when somebody needs to test an app against a city they cannot drive to. iOS hands that coordinate to apps through Core Location, the ordinary interface every location-aware app already calls, and what arrives is a latitude, a longitude, an accuracy radius and a timestamp. That structure has no field describing where the numbers came from. That is a fact about the interface and not a guarantee about anything, because apps can still infer from context: see whether apps can detect location spoofing.

This used to require a jailbreak, which is why so much old advice still says it does. It has not been required since iOS 16. Developer Mode is a switch in Settings, it needs physical access to the phone and the passcode, and the phone reboots when you turn it on. Nothing is removed and nothing is patched.

Android reaches the same result by a third route. The platform has an explicit mock location provider, an app is nominated in developer options to supply fixes, and those fixes are tagged as mock, so any other app can ask whether the position it just received was faked and get a straight answer. Same phrase, different mechanism.

What device simulation does not do is worth spelling out, because people assume it does more:

• Your IP address is untouched. Anything guessing your location from your connection is unaffected.
• The Wi-Fi networks and cell towers around you are the real ones. Anything with permission to scan them sees where you actually are.
• No other device is affected. Not a second phone, not a watch, not a car.
• The past is not rewritten. Photos taken, trips logged and history already uploaded stay as they were.

The third thing people call GPS spoofing

A VPN gets called GPS spoofing constantly and is neither of the two above. It changes the address your traffic appears to come from, so a website guessing your country from your connection guesses differently. It does not touch Core Location. An app that asks the operating system where the phone is gets the real answer whether a VPN is running or not, which is why a streaming service believes you and a maps app does not. That is common enough to have its own page: does a VPN change your GPS location.

Why the conflation matters

Because the alarming coverage of the first gets attached to the second, and people end up believing that changing their own phone’s reported location is in the same category as interfering with an aircraft. It is not, and no honest reading of either activity puts them together.

It cuts the other way too. Someone reading only the consumer coverage might assume signal spoofing is a harmless curiosity. It is not that either.

There is a duller cost too. Somebody working out why their delivery app keeps putting them one street over ends up reading about aircraft navigation, and neither question gets answered. If your own phone is simply wrong about where it is, that is usually neither kind of spoofing. It is ordinary positioning error, and the causes are mundane.

The legal split follows the same line

We are not lawyers and none of this is advice. But the two meanings land in different legal places for the same reason they land in different technical ones. Broadcasting counterfeit satellite signals interferes with a shared public resource and other people’s equipment, and is regulated as radio interference in most countries. Changing the number your own phone reports is not itself prohibited in the jurisdictions we have looked at, which is narrower than it sounds: it can still breach an app’s terms of service, and who you are misleading matters a great deal. Is location spoofing legal covers that properly.

Where we sit in this

PinDrift is entirely the second thing and irrelevant to the first. It is a desktop app, and an iPhone app, that set the location the phone reports through Developer Mode. It broadcasts nothing, it affects no device other than the phone it is setting, and it would be of no use to anybody interested in the aviation story. If you arrived here from coverage of the signal-level version, this is not that tool, and nothing that does that should be a consumer download. Our acceptable use page says what we will not help with.

One of these is a radio problem a handful of specialists work on. The other is a setting. Working out which one you are reading about is most of the work.