Elizabeth Cronan, VP of Government Relations at GeoComply, discusses what separates compliance-grade geolocation from simply collecting location data, and the one investment she’d tell any operator to make first.
Across 25.6 billion geolocation checks last year, GeoComply’s threat research team identified a new location spoofing method or variant every 18 hours on average.
Spoofing tactics detected by GeoComply
*List is non-exhaustive
Remote Desktop Protocols (RDP)
Spoofing by remotely controlling a device via RDP software, sometimes detectable by active remote desktop processes.
Virtual Network Computing (VNC)
Spoofing through remote access using VNC clients.
Rooted or jailbroken devices
Using devices with root or jailbreak access to bypass security and spoof location or identity.
Device emulation and virtualization
Employing virtual machines or emulators to simulate devices and mask true device identity or location.
Device farms
Clusters of devices used for coordinated fraud. Identified by shared IPs, WiFi SSIDs, and device behavior patterns.
Reverse tethering protocols
Using PC internet connections on mobile devices to spoof location without affecting location scanning.
VPN use
Masking IP and sometimes GPS location by routing traffic through VPN services.
DNS proxy spoofing
Redirecting DNS queries through proxy servers to fake IP-based location data.
Flashing spoofing apps
Installing spoofing apps as system apps to evade mock location detection.
OS-specific emulators
Using emulators tailored to specific operating systems to simulate device environments and spoof location.
Manipulation of XML requests
Altering XML request data to inject false location or device information.
Debugger and CRLF injection attacks
Using debugging tools and code injection to manipulate app behavior and spoof data.
System app spoofing
Converting spoofing apps into system apps to gain elevated permissions and avoid detection.
Changing app package names
Renaming or cloning spoofing apps to evade detection by package name filters.
Hard device reset
Factory resetting devices to remove traces of spoofing or fraud activity.
Browser manipulation
Using browser extensions or specialized browsers to fake location or evade fingerprinting.
Being on the right side of a compliance decision is high stakes. But it’s not the only risk question you can answer with that intelligence.
What is compliance-grade geolocation?
Compliance-grade geolocation isn’t just location data. It’s location and device integrity data collected from the most accurate, reliable sources and then authenticated, so you know it hasn’t been masked, spoofed, or manipulated by the person on the other side of the transaction. Get that wrong and the problem isn’t one gap. It’s a gap underneath everything you’ve built on top of location: AML screening, sanctions compliance, fraud detection, and account security.
Compliance readiness isn’t a box you check once. It’s a moving target, and few people have tracked its movement as closely as Elizabeth Cronan. For the past six years she has led government relations and regulatory affairs at GeoComply. With nearly two decades in gaming and regulatory policy behind her, including six years at the American Gaming Association and earlier roles at IGT and in law—few people have experienced the compliance landscape shift first hand from as many angles.
Here’s the playbook, in her words.
What does it take to make geolocation compliance-grade?
Collecting location is easy. Verifying it is the real job.
“It comes down to two things. First, you have to collect the most accurate, the most reliable location data points. Historically, organizations leaned on an IP, but an IP address can’t always be trusted. It’s not reliable, and can be easily manipulated. Device-level location is more dependable: it reads the signals coming straight from the person’s device, like GPS, WiFi, and cell tower data, to place them where they actually are.
Second, you have to authenticate those data points to determine a person’s true location. You need to be sure they haven’t been tampered with, masked, or concealed by someone trying to reach a platform from a place they’re restricted from. If you rely on a single data point, you’ve created an opening for risk.
Why is an IP address not sufficient for geolocation compliance?
IP addresses can be inaccurate and easy to spoof.
There are still large, sophisticated organizations, financial institutions, fintech platforms, and crypto exchanges, that lean heavily on IP-based location. That’s been the status quo for decades, and Cronan points to it as one of the most fixable gaps in the market.
“Most of the risk comes from IP addresses that are easily spoofed. At the simplest level, anyone can download a free VPN in seconds and appear somewhere they’re not. On a more sophisticated level, organized actors can route traffic through residential proxy networks that borrow real home IP addresses, so the connection looks like an ordinary local player. The person sitting behind that transaction may be in a high-risk or comprehensively sanctioned location.
Without determining their true location, you’re letting them onto the platform and letting them open accounts that can be used for money laundering, fraud, or sanctions evasion. Moving off an IP-only approach to something that reads and verifies multiple location data points can be made simple by dynamically stepping up to precise device-level location only when the risks or regulation demands it. This is transformational for AML, fraud prevention, and financial crimes compliance.
How should compliance teams pressure test their geolocation setup?
Treat your compliance stack like a prosecutor in discovery.
When Cronan was asked how a compliance officer should pressure-test their setup before a regulator does, she imagines the courtroom. Not an engineering standup.
“Treat the geolocation stack the way a prosecutor would in discovery in contentious litigation. This isn’t just an engineering team working through a sprint review. The system needs to be tested. Is it detecting the most sophisticated spoofs? Not just a simple VPN, but GPS spoofing, jailbroken and rooted devices, and all the edge cases in a landscape that keeps evolving.
Checklist: What to look for as you pressure-test your compliance stack
Look for coverage across location, device behavior and identity signals. This includes GPS spoofing apps, jailbroken and rooted devices, emulators and virtual machines, device farms, remote access tools like RDP and VNC, reverse tethering, and residential proxy networks.
This is the discovery test. If an examiner asks about one specific transaction, the vendor’s records should show how the signal was established, not just return a pass or fail.
Detection quality depends on having watched attacks evolve over time. A model informed by a long, broad view of actual spoofing behavior catches what a fresh dataset misses.
The same signal should strengthen AML screening, sanctions compliance, and fraud detection, not only answer “am I licensed to operate here.”
New methods and variants surface constantly. Ask how your system finds emerging tactics and how quickly you can ship detection for them.
Detection should update as the landscape shifts, rolling out in the background rather than waiting for your next contract cycle.
Demonstrate a track record of certification in your target jurisdictions, and of maintaining it as the threat landscape moves.
Test your system’s accuracy and false-positive rates, and see if it steps up only when risk or regulation calls for it, so legitimate customers aren’t caught in the net.
Confirm data is encrypted, secured, and used strictly for compliance and fraud prevention. Do not resell or repurpose the data unless it’s been clearly disclosed.
How does precise geolocation enhance AML, sanctions and fraud detection?
Your location signals build the floor under AML, sanctions, and fraud.
This is the point Cronan comes back to most, and it’s the one that reframes the whole cost conversation. Location isn’t a gaming-license checkbox. It’s a data input that everything downstream quietly assumes is solid.
“If an organization’s geolocation signal is inaccurate, if it’s spoofable, if it can be easily manipulated, that’s not just a gap in one control. It’s a gap underneath every downstream control that assumes location is a known, trusted fact. You can’t reliably flag structuring, layering, or activity that could stem from a sanctioned jurisdiction if you can’t first establish where a transaction actually originated. And the enforcement and penalty exposure scales accordingly.
The takeaway for anyone pricing the cost of compliance: the real cost of getting geolocation wrong is never just a gaming fine. It’s exposure across every compliance obligation that assumed the location signal underneath it was solid.
How does geolocation strengthen KYC and customer due diligence?
Knowing your customer means knowing where they really are.
“Truly knowing your customer requires knowing their true location. Not just when they create an account, but throughout their entire customer journey and lifecycle. Anyone who wants to engage in illicit activity on a platform, the first thing they do is mask or conceal their location. Take that tool out of a bad actor’s kit and you have a meaningful impact on the fraud rates we know are prevalent across financial services, fintech, and crypto.
How does location data serve compliance without compromising user privacy?
Use privacy is built on transparency and trust.
One objection comes up constantly: isn’t device-level geolocation an intrusion on user privacy? Cronan’s answer starts with how people already live online.
“People share their location many times a day for everyday experiences. Booking an Uber or a Lyft, checking the weather. There’s a real comfort and familiarity with it. And in regulated markets, there’s a high degree of transparency before any of this data is collected. People are far more comfortable sharing their location when they know it’s being used to secure and protect their account.”
The trust, she’s clear, has to be earned by what a provider does with the data after it’s collected.
“The most trustworthy organizations in this space use that data for compliance and fraud prevention. It’s held, secured, and encrypted, and it stays inside its stated purpose. You can get the compliance and fraud benefits and protect the consumer at the same time. Those two aims aren’t in conflict.”
Why do emerging markets benefit from compliance-grade geolocation?
In emerging markets, geolocation does double duty in fraud and compliance.
Prediction markets, sweepstakes, and social casino all sit in contested legal territory today, with attorneys general and regulators moving fast. For operators building in that space, Cronan frames geolocation as doing two jobs at once.
“The geolocation system has to move as fast as the law does. When a court rules or a state passes a law, you need to be ready to restrict operations in that market. So the integration has to be done and ready to switch on. But at the same time it’s the fraud backbone. In these categories geolocation is doing double duty. It’s compliance, and it’s the primary defense against fraud.
The tactics that location intelligence is catching first in these verticals is specific: account takeover, where a login pattern that’s wildly inconsistent with a user’s history is one of the fastest ways to flag a compromised account before money moves. Multi-accounting, where one person spins up dozens of accounts to farm a promotion. And coordinated fraud rings, clusters of accounts operating from related devices in concert, the pattern an account-level control misses entirely.
The one investment operators should make for the next 90 days
We closed by asking Cronan the operator’s question directly: if you’re entering one of these emerging verticals and could make a single investment this quarter, what is it?
“Make sure you have the right location detection program in place from day one. Not just for jurisdictional compliance, but as part of your AML program, your sanctions screening, and your fraud prevention. Too many organizations still think of geolocation as a single-purpose tool that answers one question: am I allowed to operate here?
The highest-leverage move is recognizing that the same signal needs to do far more than that, and making sure it actually can. A gaming regulator, an AML examiner, and a sanctions investigator can all end up looking at the exact same transaction. The organizations that are ahead already built detection that serves all of those obligations at once, instead of treating each one as a separate box to check down the line.
That’s the readiness test in a sentence. Not “can we answer the jurisdiction question,” but “will this same signal hold up when three different authorities ask about the same transaction from three different angles?”
See how your geolocation stack holds up against modern spoofing threats.
Elizabeth Cronan | VP, Government Relations
Elizabeth Cronan is Vice President of Government Relations at GeoComply, where she leads federal regulatory, policy, and advocacy work focused on fraud prevention, digital identity, and AML, KYC, and sanctions compliance. She turns fast-moving policy developments into practical guidance for organizations across financial services, iGaming, social media and more.
FAQs
Compliance-grade geolocation is location data collected from accurate, reliable sources and then authenticated to confirm it hasn’t been spoofed, masked, or manipulated. The distinction that matters is verification: collecting a location signal is easy, but proving it reflects a person’s true location is what stands up to a regulator.
No. An IP address can be easily manipulated with widely available tools, so an IP-only approach misses a large share of the risk. Compliance-grade programs read and verify multiple location data points rather than trusting a single unreliable one.
Location is a foundational input for AML and sanctions programs, because you can’t reliably flag structuring, layering, or activity originating from a sanctioned jurisdiction without first establishing where a transaction actually came from. If the location signal is spoofable, that weakness sits underneath every downstream control that assumes location is trustworthy.
Yes, and for two reasons at once. Geolocation lets these platforms restrict activity market by market as the legal picture shifts, and it acts as a primary defense against fraud typologies like account takeover, synthetic identity fraud, first party chargeback fraud, payment fraud and promotion abuse.
