Hello, I'm currently building an application that can be used to process orders with mobile devices on events. The application allows self-service for guests with their own mobile device.

To get to the order process and to determine if the person is really at the event the application uses unique URLs and QR codes for each table.

The problem is that orders can still be done even if the guests are no longer on the event (even if they are logged out after a certain time), because they know the URL or have taken a picture of the QR code. Also URLs/codes can be sent to other persons.

I think about using GPS as additional check, because it's little harder to bypass, but risky if the event is indoor (?).

Are there any other possibilities to ensure that a person is at a specific location?

Thank you, btw. the application: http://www.orderlink.io