Destination substitution: an advertiser investigation guide

A customer reports that an advertisement led somewhere different from the page your partner approved. Treat this as a routing incident that needs evidence, not as an immediate verdict that a publisher committed fraud. A language version, an expired campaign, a compromised script and intentional concealment can produce superficially similar screenshots. They require different remedies.

This guide gives advertisers a bounded procedure for investigating a suspected destination substitution. It does not explain how to build cloaking or evade review. Work only on assets you own or are authorised to inspect. The two examples are fictional training scenarios in USD, not incidents or results from AffiliateCore. The method is cross-market; it does not establish permission to advertise a restricted product in any country.

Contents: Boundary · Incident record · Investigation · False alarm · Confirmed substitution · Recovery.

1. Separate a different presentation from a different promise

The question is not whether two screenshots are pixel-identical. It is whether the promoted product, important conditions and next action remain consistent with what the visitor was promised. Translated text can preserve the same proposition. A page that promises a scheduling demonstration and sends a visitor to an unrelated paid subscription does not preserve it.

Google's circumventing-systems policy prohibits cloaking intended to conceal violations. That platform rule is a reference; the incident process below is our operational proposal. An internal investigation cannot guarantee how an advertising platform will decide an appeal.

Define the approved route before you assess a deviation. Record the creative version, source category, landing domain and page, approved redirects, product, material conditions, expected user action and change owner. For an AffiliateCore offer, keep the written traffic and destination requirements aligned with the actual offer and approved partner campaign. Our platform is the place to organise the agreed offer and recorded results; this article does not claim that it automatically detects cloaking or preserves all web evidence.

Do not make a live test registration or payment to generate a conversion. If the route requires an authenticated demonstration, arrange an authorised test environment and clearly excluded test events. Do not request another person's credentials or copy their private browser session.

2. Open one incident record with a limited evidence set

A useful record contains: incident ID; reporter and authorised contact; time and time zone; affected offer and campaign identifiers; observed URL and final destination; device and browser; expected versus observed proposition; evidence references; scope estimate; current protective action; owner; next review time. Keep personal information out of broad team messages. A case ID is usually enough to coordinate the investigation.

Ask for a screenshot of the unexpected promise and the address bar, with personal details redacted. Ask what action preceded it, such as clicking a named button. A screenshot by itself does not establish the entire redirect chain or who controlled the destination. Mark it as a report until you can corroborate it.

For assets you control, preserve the relevant configuration version, deployment record and narrowly scoped access logs before making a correction. Store the evidence with access restrictions and your established retention policy. Do not gather a complete customer browsing history. If a network export is needed, remove cookies, tokens, submitted form values and unrelated requests before sharing it.

Use an evidence table rather than a narrative accusation:

Checkpoint: a second reviewer can distinguish the verified observation, the inference and what remains unknown. If they cannot, rewrite the record before deciding responsibility.

To prepare the commercial boundary, register as an advertiser in AffiliateCore and prepare your offer's allowed sources, destination requirements and acceptance rules. Account creation and an offer draft do not constitute approval of the route or a guarantee of partner traffic.

3. Investigate without increasing exposure

1. Triage the consequence. An unexpected language deserves review; an unrelated payment request or apparent credential collection deserves immediate protective action. Pause the affected placement or campaign where you have authority, rather than waiting for a statistical sample when users may be harmed.
2. Fix the reference. Save the approved creative and destination version. Confirm that the reporter describes the same campaign and time window. An old screenshot compared with a new release is not a controlled comparison.
3. Inspect the authorised route. Follow the ordinary user journey on a clean test session, without submitting a payable event. Record the addresses and material propositions. Stop before downloading unfamiliar software or entering credentials on a suspicious destination.
4. Compare records. Review your own deployment changes, redirect configuration and approved third-party components. Ask the responsible partner for the matching version and explanation through the normal authorised business channel. A missing answer is a limitation, not proof of intent.
5. Test benign explanations. Check whether an expired promotion, documented localisation, accidental redirect or compromised component explains the difference. Change one known condition at a time on your own staging environment. Do not probe third-party protection systems or impersonate a reviewer.
6. Classify the finding. Use clear states: not reproduced; explained legitimate variation; accidental misrouting; confirmed unauthorised substitution; insufficient evidence. Attribute intent only when evidence supports it. Keep the confidence and unresolved questions alongside the state.
7. Define the remedy. Remove or correct the affected route under your authority, document the change, review impacted records against existing terms and decide what evidence is needed to reopen. Do not silently rewrite historical events.

The required output is a reasoned incident decision, not a tool screenshot count. A clean result at one moment does not prove that every visitor always saw the same page. Conversely, one inconsistent screenshot does not justify rejecting all of a partner's legitimate results.

4. Teaching scenario: a localisation difference mistaken for substitution

Assume a publisher sends visitors to a training provider's consultation page. A complaint says the page looks different in another language. The approved documents identify the same provider, consultation and fee conditions in both versions. Your review confirms that a translated heading and button differ, while the product and important terms match. No unrelated destination is established.

The investigation takes three analyst hours at $30, two partner-review hours at $25 and one verification hour at $30. A dedicated test environment costs $20. Total review cost is $190: $90 + $50 + $30 + $20. These are assumed costs, not prices for any named service.

For the bounded cohort, 40 actions were recorded. Six fail the pre-existing acceptance definition, four are cancelled, two remain pending and 28 are accepted. At an illustrative $20 partner payment per accepted action, the payable amount is $560. Campaign preparation allocated to this cohort is $250; total listed cost including review is $1,000. Cost per accepted action is $1,000/28 = $35.71. If the advertiser's documented ceiling were $40, this cohort would be within it; the ceiling itself is a teaching assumption, not a recommended universal rate.

The artefacts are a side-by-side proposition checklist, references to both approved language versions, the version dates and a short finding: “Legitimate localisation confirmed for the reviewed route; no evidence of concealed product substitution in the checked conditions.” It must not say “fraud-free forever”.

Reopen only after a second reviewer confirms the important terms and the customer-facing wording is clear. The six rejections need their ordinary individual reasons; the four cancellations remain cancellations. Do not convert the two pending actions to accepted because the page incident was resolved. The routing conclusion and the conversion decision are separate records.

5. Teaching scenario: unauthorised destination confirmed

Assume an approved route leads to a software consultation. A controlled record on infrastructure you own shows that a changed redirect sent some visitors to an unrelated subscription. Deployment history identifies the changed component and the responsible access path. This establishes an unauthorised route change; responsibility and intent still require review of the available evidence.

Pause the affected route, preserve the relevant version and restore the approved destination through the normal change process. The evidence pack contains the approved route, the observed final destination, time-bounded configuration history and the corrective change. Do not reproduce the deceptive mechanism in a public tutorial or circulate a working suspicious link to the whole team.

Assume 50 actions were recorded in the affected cohort. Ten are rejected with documented reasons, five cancelled, ten remain under review and 25 are accepted under the existing criteria. Do not automatically reject every record because it falls within the incident window. Accepted partner payments at $20 total $500. Allocated media and preparation cost $400. Investigation requires six hours at $30 and remediation two hours at $30; permitted customer handling costs another $60. Total listed cost is $1,200: $500 + $400 + $180 + $60 + $60. Cost per accepted action is $48.

At the illustrative $40 ceiling, economics already fail. If all ten pending records were legitimately accepted at the same rate, cost would rise to $1,400 for 35 accepted actions, or $40 each. That arithmetic is not permission to resume: the route still needs a verified remedy, and pending outcomes cannot be assumed.

Stop conditions are immediate user-risk exposure, inability to establish a controlled approved route or repeated unexplained changes. Reopening requires a documented fix, independent verification, restricted change ownership and a small authorised observation window. Do not buy more traffic simply to dilute the incident cost. Any refund, cancellation or payment decision must follow actual contractual rules and the evidence for the affected record.

6. Reopen deliberately and preserve what the incident taught you

Use a short reopening checklist: approved route version restored; material terms consistent; access to change the route restricted to named owners; third-party component changes reviewed; affected cohort separated; individual outcome reasons retained; next monitoring time assigned. Record who authorised resumption and the scope. A staged return is a business decision after remediation, not a claim that a small test proves complete safety.

Typical mistakes include treating all localisation as deception, confusing a broken link with intentional concealment, publishing raw logs with personal data, accepting every conversion after a technical fix, or blaming a partner before checking your own compromised components. Each mixes questions that need separate evidence.

Existing advertisers can open their AffiliateCore account to review the relevant offer and agreed conditions. Keep the incident evidence in an appropriately restricted system; do not assume the platform's ordinary conversion list is a full forensic archive. If the event definition itself is unclear, first use a written acceptance specification and resolve the ambiguity before scaling.

Practical assignment: prepare one approved-route sheet and one empty incident record for your next partner test. Define who can pause, who investigates, what evidence is sufficient to reopen and how review costs enter the cohort calculation. Rehearse using a harmless staging mismatch, without creating live payable events or exposing customers to an unsafe route.

Sources checked 15 October 2026: Google Ads policy on circumvention and Google Search spam policies. The training scenarios, cost models and incident templates above are original instructional examples.