In various embodiments, position of a user device is estimated by scanning for WLAN packets transmitted within range of the user device, the scanning to include a plurality of phases which are progressed through until WLAN information sufficient to identify at least a threshold number of WLAN APs is obtained, the plurality of phases including an active scanning phase in which the RF module transmits probe request packets and receives one or more probe response packets, and one or more passive scanning phases in which the RF module listens for one or more packets without first transmitting request packets, extracting WLAN information indicating an identity of one or more WLAN APs from the one or more probe response packets or the one or more listened for packets, and providing the WLAN information to a WPS to obtain an estimate of the position of the user device.