The last bit is a big one. They have no way of knowing your citizenship. Even if you've never logged in with that country's IP addresses, you could have a dual citizenship or be an expat. How will they know if I claim to be German? Even if they ask for proof, I could send them a driver's license pic from the Internet with all information redacted for privacy and security reasons.