I had several legitimate businesses ask me for that. Thankfully they were fine with obscuring all but the last 4 digits of the card.

I don't get why they do it though. Faking a card photo is trivial so anyone trying to defraud them will just do so. These guys can manufacture physical replicas of cards to cash them out at ATMs, do the companies really think they won't be capable of altering a picture?

I'm assuming someone somewhere told them to do it and nobody took a minute to actually look into it deeper and realise how easy it is to exploit (and thus useless at preventing fraud).

> someone somewhere told them to do it

And/or it ticks a checkbox in some compliance checklist.

now THAT is ridiculous.

To pay for enrollment in their iOS dev program (to publish iOS apps) Apple asked me to FAX my credit card data to a USA phone number so that they can charge it manually. Told me that that was the only way of enrollment from my country of residence at that time. Things changed now and they allow online payment but that was also ridiculous. They literally had a form on their website that I printed and filled in my CC data to appropriate boxes. Then had to find a fax machine to send it.

To be fair I had to use this very process to book a hotel in the Caribbean just last year - a hotel owned and operated by a British company!

So Caribbean hotel, adult streaming site and Apple can be compared as on the same tech competency level for online payment without blinking. Okay, didn't expect that one today.

I don't think a hotel in the Caribbean, regardless of the owner, quite compares to one of the richest computing companies in the world.

You'd be surprised but established brands like Arcteryx ask their customers to email pictures of their passport and credit card. Email. Pictures. Yes, you've read that right. Given how stupid such request is (from data security and privacy points of view), I'm sure they treat that data properly. /s

Many "legit" crypto exchanges ask for these kind of infos as well.