They could do something similar to what Facebook does: as soon as they detect a new device using your account, send an email. If the new device is not in the same country as your other devices, don't allow purchases until you've clicked on that link in your email.