Perhaps even looking at credit card billing addresses or issuing banks maybe, if they're non US based and service is being accessed by a US IP address could rai

Perhaps even looking at credit card billing addresses or issuing banks maybe, if they're non US based and service is being accessed by a US IP address could raise a flag? Just my speculation.