In 99% of the cases it is your card issuer that is making the fuss. They especially like "offshore" transactions. IP/email means nothing.

Some issuers are ultra overprotective of their card holders.