How susceptible are check-in-based location services to location-spoofing?

use network-side location APIs to mitigate handset-based spoofers

If you ask about commercial implications, the problem is not in the check-in itself, but in rewarding customers for showing up only. At times where online shopping took a great deal of business from brick and mortar stores, I can understand the excitement on bringing the customers back to the door. Nevertheless, while it’s true that the first step to have a sale is having the customer there, rewarding them just for showing up without following up on a sale doesn’t make much sense in the long run. The real value of Check-ins, stamps, and other incentives should reward more than just physical presence - that's the commercial implication. More thoughts on this here: http://bdnooz.com/2010/12/13/check-in-and-location-based-marketing-%E2%80%93-lessons-from-the-future/

On iPhone, there are currently only two location-faking apps, and only for jailbroken phones. Both just preload a library and they fake a location that remains the same for all the tricked app life time. Hence, detecting Fake Location and Location Spoofer is straightforward. On Skyrock Spot, if one of these tools is detected, the app considers the location as untrusted and parts of the app are disabled (being close to a virtual object doesn't grab it in order to collect coins). On other operating systems, like Android, it looks quite more challenging to detect location spoofing. And still, detecting Fake Location and Location Spoofer on iPhone is not bullet proof.

A medium/longer term answer is to look to more granular (precise) location technologies that are more battery friendly than GPS.  Using a two-way technology that can support public key encryption will also help a great deal.  More thoughts on this here http://ht.ly/3BBOm

Services that allow check-ins via websites are the most susceptible as creating a fake location service for a desktop browser accessing a mobile website is far easier that hacking a mobile app and/or a mobile device's core location services.

The platform is irrelevant - mobile, website, smartphone - they all communicate with LBS servers through a API that trusts the coordinates it receives. Location spoofing is trivial. Scott gave a good answer, in that developing heuristics that flag or cripple bad behavior behind the scenes is the only real tool now to defend against deceptive data. Of course, the other tool at our disposal is product design, assuming that a user can spoof their location and building your coupons or deals or races or takeover games or whatever such that the consequences of spoofing are understood, limited, and negligible.

A check-in service coupled with a "pics or it didn't happen" mechanism might offer a more robust solution to location spoofing.