Perhaps even looking at credit card billing addresses or issuing banks maybe, if they're non US based and service is being accessed by a US IP address could raise a flag?

Just my speculation.