There are several situations where the IP location for a given user id will not match their billing address, credit card country, etc.  One benign example is when someone on a vacation buys from you.  Many times they will be outside their country of residence on vacation, so the IP address they use will show up as being in a different country.

A malicious example is when a fraudster is attempting to buy from you with stolen credit cards.  Often time their IP location will not be in the same country as the addresses on some or all of the stolen credit cards they are trying.

Sift identifies when the IP location does not match the billing address, credit card country, etc. and factors this into scoring.