Exactly! But how can an account with 5 transactions be marked as fraudulent? The answer, I think, is probably my speculation number 3 — it might be IP address related. And if this is indeed the case, then their security is so strict to be meaningless to them (as a fraudster will probably just use a different network) and bad for their users.