The usual ways it happens
Most attendance fraud is small and social: a friend signs a sheet, reads out a code, or carries a second phone. Others clock in and leave, then come back to clock out. A few use technical tricks to fake a phone's location. Each needs a different answer, which is why one check alone rarely holds up.
Why GPS alone isn't enough
A phone reports its own location, so a location check trusts the device being checked. Fake-location apps exist, and a whole-building fence can pass a student in the parking lot. Location is still worth having, because it stops casual cheating and creates a record. It just shouldn't be the only thing you rely on.
Layers that work together
A code shown only in the room means someone has to be there, or be told by someone who is. Tying each account to one phone, and confirming with Face ID or Touch ID, makes it harder to clock in for someone else. Checks at random times during class catch people who leave. None of these is perfect, but beating all of them at once takes real effort, and it leaves a trail.
Keep a person in the loop
The strongest single control is an instructor counting the room. Have them count before seeing the list of who clocked in, so the list can't influence the count. If the numbers don't match, someone should check names. AttendVia builds its sign-off around this. It's also fair to tell students plainly that attendance is checked, and that a false record has consequences, since most people don't cheat when it's clearly not worth it.