Fakin' it

For a taxi customer Finland is a very safe place. If you take official taxi the risk of being mugged or cheated with rigged meter is very close to zero. Since I deal with equipment, I concentrate on the latter case here.

A common way to cheat with a meter is a device that injects extra signal to meter, generating impression that car is moving faster/further than it really is, and thus generating higher fare.
Since Finland happens to be so safe in this context, this of course means that I haven't encountered such devices myself. I would like to however (in sense of someone sending me one for examination, not in sense of finding one installed in taxi I'm working with), since I'm really interested on how they work - and of course I would like to incorporate some kind of tech to detect these.

It's been several years since I first heard (and considered) the issue, but only about a year ago I started to get a bit more interested. Since these devices aren't exactly legal, I haven't had a change to examine them in detail (after all, knowing how they work would make defence easier), so I have to rely on information I've found from the net.

After some searching I found two class of devices: First class are connected to meter by directly cutting the wire and adding a switch that switches between normal pulse and pulse generated by an generator that continuously pretend to be driving at high speed (and thus generating high fares). There may also be signal injection involved (add new signal on top of another), but again, details are vague. Either way, since there is direct wire splicing involved, these devices could be detected even after being removed by inspecting meter wiring for irregularities.

Second ones are more interesting. Apparently (details are very thin; this is the reason why I'd love to get my hands on a few of them) they work by inductive or capacitive coupling, and they generate extra pulse on top one coming from vehicle, fooling the meter to run at higher rate (so basically similar to above, but without the need of cutting/splicing wires).

After few hours of thinking I had thought up maybe three different ways to detect both cases of tampering; in a day about 10 or so, each with both pros and cons and with varying implementation
difficulties. Some of these are variations of same ideas so I don't even try to cover them all.

When thinking of these I also realized that despite solutions should be very easy for any engineer who is worth their pay once they actually encounter the problem, someone might still try to patent them, despite of the "inventiveness" factor being near zero.

So, some cases I thought up within first hour;

If you have a GPS you can trust, you can of course compare speed reported by it against speed measured by meter. Significant difference is of course major red flag. The GPS signal doesn't have to be always on for this to work (garages or high-rise building blocking signal and so on), but if you never get signal there is a problem (antenna blocked).

GPS isn't often an option, so you'll need to analyze the signal itself. The "constant pulse generator" is of course on first glance easiest to detect. If the speed remains unchanged for too long, then there
is a generator involved. Unfortunately there is problem, and it is called "cruise control". Cruise in my car can hold the speed within 1% (yes, one percent) easily for several minutes, and for shorter periods
even at 0.1% (why yes, I do have a meter in my car that can measure speed with one tenth of km/h, designed the thing myself, Eltrip-65n to be specific). You can see how this could make a terrible false positive if triggered.

Signal timing, then. Quick changes in signal frequency - like jumping from "5 km/h" to "50km/h" within 0.1 seconds - is pretty clear red flag, and very easy to implement.

Then there is signal shape which will be altered if there are external (injected) signal overlapping the real one. Normally you expect the signal you receive to have fairly constant duty cycle, typically (but not in every car) 50%. If there is variation there, there just might be something fishy.
You'll have to be careful though, you don't want this to trigger if car for some reason really has slightly irregular duty cycle (say, sensor elements aren't placed exactly 180 degree (or 90, or whatever) difference) . So some signal processing is most likely required - I think variations of algorithms that can be used for this  counted half of ideas I eventually had, from comparing pulse  length to previous one to capturing longer sequences (tens of pulses) and analysing them then afterwards. Either way, it all boils down to fairly simple analysis of pulse periods, so I won't go further in details. I hope I made my point clear already.

And yes, this of course can apply to any case where there can be pulse signal forgery involved, not just taxis.