How the system prevents Mobile device clock tampering

Preventing device clock tampering.

When a user is connected to the server through the app, the server clock is used to determine the time of a transaction. When a mobile client device connects to the server, the internal clock on the device is synchronized to the system clock. This synchronization allows the mobile device timestamp to correspond to the time on the server. The system is able to calculate this time in a manner that is unaffected by changes to the local clock on the device.

When the system processes an offline mobile transaction, the system checks that the mobile device clock is synchronized with the system clock. If it cannot be determined that the two clocks are “in sync,” then the transaction is flagged with an “Unverified Time” comment.

When the mobile device is rebooted (turned off), the clock synchronization with the server is lost. If an offline transaction is performed and the device is then rebooted before reconnecting to the server, the clock calculation cannot be verified. In this case, when the app reconnects to the server and the offline transactions are processed, those transactions are marked as “Unverified Time.”