Three locations that are easy to confuse
Apparent network location is the region associated with the public IP. Device context includes browser language, time zone, system settings, and network behavior. Physical location is where the person actually is. A standard website script can observe some of the first two; it should not pretend that either one is perfect proof of the third.
What makes a mismatch stronger
A mismatch becomes more interesting when multiple independent clues move together: the public IP is a known exit network, the browser context is inconsistent with the campaign, the session is part of a repeated cluster, and there is a measurable business outcome gap. Even then, the output should be “displacement suspected” or “review required,” not “this person is a fraudster.”
What makes a mismatch weaker
Travel, corporate remote access, mobile carrier routing, privacy relays, and household devices can all create unusual combinations. A location difference without suspicious behavior is a reason to preserve context, not to block.
Evidence language matters: “apparent IP region differs from campaign or session context” is more defensible than “we know the user’s real country.”
See how BotRefund keeps geo evidence separate from bot verdicts and why VPN and bot labels should not be merged.