FakeTraveler: Fake where your phone is located (Mock location for Android)

Original Article ↗ Hacker News Discussion ↗

Android’s long‑standing mock location feature enables apps like FakeTraveler to spoof GPS coordinates, but many modern services can still detect or bypass these fakes. Commenters describe how platforms such as Google Play, banking apps, and location-based games cross‑check IPs, Wi‑Fi/cell data, sensors, and OS attestation to enforce regional locks and anti‑fraud rules, often defeating simple GPS spoofing. This raises a broader tension between users who want granular control or obfuscation of their location for privacy, pricing, or testing, and companies that depend on hard‑to‑fake device location and integrity guarantees.

Google Play region and geofencing

  • Mock GPS alone does not fool Google Play country.
  • Reported working recipe: no SIM, Wi‑Fi via a VPN’ed hotspot in target country, GPS off, and a payment method from that country.
  • Play country can only be changed once per year and is tied to billing details and Google’s broader location signals.
  • Some users maintain multiple Play accounts, each bound to different countries and cards.

Technical limits of Android mock locations

  • Since ~Android 9, apps can query whether mock location is enabled (isMock()), so many can detect faking.
  • Without root or a modified OS, you cannot hide that a location is mocked.
  • Banking and game apps (e.g., Pokémon Go, other GPS games) typically detect and block spoofing; bans are reported.
  • Simple dev‑options mock providers are mainly useful for testing, not defeating anti‑fraud checks.

Location tracking channels beyond GPS

  • Google can infer location from: Wi‑Fi and cellular networks, IP addresses, photos’ GPS metadata, documents, billing addresses, and device sensors (accelerometer, barometer, compass).
  • Android can passively scan Wi‑Fi even when Wi‑Fi is “off,” and nearby APs are used for positioning.
  • Cell networks can locate phones via tower triangulation.
  • Some suggest only extreme measures (Faraday cage, hardware kill switches) meaningfully block all channels.

Privacy, user control, and “trusted” devices

  • Strong disagreement over whether unspoofable location is a feature (for fraud prevention, ride‑hailing, emergency services, rentals) or an anti‑user restriction serving corporate interests.
  • Some argue users should be free to lie about location, and businesses should not rely on client‑side trust.
  • Others stress that easy spoofing would raise fraud and degrade services that depend on reliable location data.
  • Remote attestation / Play Integrity is criticized as shifting power from users to OS vendors and app developers, similar to broader “trusted computing” debates.

Alternatives and related tools

  • FakeTraveler is valued for being open source and on F‑Droid; many Play Store mockers are ad‑heavy or broken.
  • Android emulators and other GPS itinerary fakers are used for testing.
  • On iOS, spoofing is usually done via external tools, MITM of Wi‑Fi/cell‑based APIs, or commercial (sometimes scammy‑looking) apps.

Why some apps still know the real location

  • Apps can ignore mocked fixes and fall back to last known real location or Wi‑Fi/cell triangulation.
  • Thus, seeing Maps “fooled” while other apps still know the true position is expected.