Probably by cookie-ing or fingerprinting your device, and then tying that to IP geolocation. They don't need to get close to 100% accuracy and they can do things to err on the lenient side. It doesn't seem that hard a problem compared to other anti-fraud systems I've seen. I think it'll probably work fine.