My company (Sift Science) uses machine learning to fight fraud, and we work with customers who sell digital goods. You're right that normal country blacklisting, IP blocking, AVS, CVV, etc. aren't terribly effective.

I think some effective techniques for digital goods are: 1) behavioral signals, such as how long the user spent browsing your site before making a purchase, 2) physical device -- have I seen activity from this particular machine before, even if they're going through a proxy to use a fresh IP? 3) e-mail address -- is it a legitimate domain? an obvious throw-away account?, 4) mismatch between IP and billing info (as you noted).

In general, fraudsters switch tactics with surprising frequency, so I'd highly recommend combining multiple types of data into a machine learning system that will adapt. Otherwise you're going to spend a lot of time tuning rules.

And if you're looking for help, feel free to send me an e-mail: brandon@siftscience.com. My company deals with fraud all the time. Even if we can't help, I'd be happy to point you to others who can.