And presumably they wanted you to send those photos to them as an unencrypted email attachment, right?
As for fake IDs, yes, it is certainly possible to create them. But when it is so much easier to socially engineer your way into another service like Namecheap, it creates a disincentive for going after Gandi (and other similar hosts).
No security measures can be foolproof, possibly short of sending someone to your home to take a DNS sample, but at least they're trying for a better solution.
That's why nobody has ever used a fake ID at a bar!
> but in germany the fake itself is punishable by law (up 10 ten years).
https://dejure.org/gesetze/StGB/267.html 5 years.
But producing fake scans isn't covered by this law, scans aren't even an official document. In fact, it is illegal for a german company to ask you to send them scans of official documents.
> You'd also need much more information to create a convincing fake id scan of your intended victim
To fake a good enough passport scan you'd need your victims name. That's all the rep is going to have.
I sent the ids by fax (yeah a few years back, I still had a fax machine).
I thought asking for id's + phoning on the number listed in the whois database was a good cross check, especially back then.
Edit: Since I'm getting some downvotes I'd really like to know how one could possibly argue that asking for ID scans is better than email resets. You can't really forge the ability to receive email at an address, but you can very easily replace the name on an ID scan.
An attacker can't just pretend to be able to read your email, such ability is too easy to conclusively prove. To be able to read your email they need to hack you somehow.
But for a fake ID the attacker only needs to throw your name in a PSD and they're good to go.