It is obviously easy for them to detect region of log in.
If he logs in from a different region then blizzard should immediately lock his account upon successful authentication. This is possible and not beyond them.
The problem is they have purposefully left it out but have established rules for what to do in case it happens.
GeoIP is useless as an indicator to actual location. Every gold farmer around learned to spoof IP addresses so they show up as being from NYC or Texas when they logon. Thats why IP bans are worthless.
Please know the subject before you converse on it.