[vivan]

Standard security practices: not allow delivery to a new address without reconfirming credit card details, sending email confirmation upon login from a new location/device, and in the more extreme cases, 2 factor auth.

[simias]

That makes a lot of sense now that you point it out. Thank you.