Kinect stops credential sharing by requiring a member's phone to be actively connected to the gym's verified Wi-Fi network at the exact moment they tap unlock. If the phone is on cellular data, a car hotspot, or a VPN, the door simply will not open. Combined with device binding, this makes the access credential worthless to anyone standing outside the building.