Well, looks like Z finally caught on and implemented additional checks. I was PM'd by a Cheapies user today about not being able to spoof anymore and I can verify this is indeed the case.
I've verified this on several phones, running different ROMs (stock and custom and all rooted) and different Android versions ranging from A10~A14. I've also tested this on Bluestacks. All have failed. Tested using several GPS spoofing apps.
The spoofing itself works fine, I'm able to get the local prices for the suburb/region that I've spoofed. But at the payment stage, it'll decline the transaction. It's the same behaviour across all the devices I've tested, including Bluestacks.
The issue isn't that they are detecting root, or detecting that you've configured mock location under Developer Settings. Those have separate checks that trigger separate errors. And it shouldn't be related to IP either, because if you're on mobile data, you could be anywhere in the country. It seems that perhaps they're accessing the FuseLocation API on Android to check for some flags.
My Z app hasn't been updated for a long time. I've purposely made it hidden from Play Store, so it's not like this is a client-side change. This all seems to be server-side related.
I've also patched my Android Framework to make mock location seem like it's getting genuine location updates, via this method - https://xdaforums.com/t/module-smali-patcher-7-4.3680053/
However, while my Location Changer app doesn't show it's using Mock Location anymore, the payment still gets declined.
The only thing I can think of is that Google Play Services is automatically updated in the background and that Z is utilizing Google Location Accuracy, which relies on Google Play Services and is probably using a newer API. Due to this, Z is probably getting a more accurate read of your real location.
The last thing I haven't tested is to find an older Android device that runs on Android 8 or 9, patch the Android Framework and then test again. The reason is that this patch isn't guaranteed to work on versions > A10 and all my current devices are on A13 or A14. I haven't gotten a bootloop or anything, and some people said it did work for them on A13, but the apps they're testing are probably games like Pokemon Go and not Z App. My current devices, including my spares, all came with stock Android > 10 and so I can't just downgrade to A8 or A9 using a custom ROM or stock ROM.
And assuming the above doesn't work, then I'd need to downgrade Google Play Services to an older APK - which is easy to do. But I'd still need an older Android device to test.
I've also tested this on 2 different Z accounts.
Without spoofing location, I can make purchases just fine.
Anyway, seems like too much effort atm.
UPDATE:
After some more testing, I managed to spoof the location to Whanganui and paid $2.69 / Litre. It seems like there is a certain location range that you can spoof to. Either that, or it could be that they've blocked purchases for the cheapest Z station in the country, which is Wairoa and has been so for the past 2 months or so (based on my monitoring). I've spoofed a few places and was able to make purchases for them, just not for Wairoa. I might need to update my automation to report the next cheapest location shown in Gaspy. But so far, I can see that Whanganui has one of the next cheapest prices.
For those interested, buy it quick before they patch the server-side or make changes to the app. You may need to adjust the purchase amount. It seems like they also check whether you're purchasing a huge amount of petrol and so breaking it down into smaller chunks may work better.
Also, I'm using the latest Z app atm. I don't think the client-side matters, it's the server-side that got updated with better spoofing detections.
There is one other trick that I haven't tried and this is something I just came up with today, but will be using this as a backup option. But I feel like there may be a Z spy lurking around the forums, so I'm keeping this to myself when it breaks again.
That is, as they say, all Greek to me