Credit card fraud protection often relies on heuristics, perhaps they are doing a similar thing here.