TLDR: You do almost the same thing in the USA, only it is automated. We have the patriot act which requires collecting a lot of info-- the US has centralized databases (namely credit reports) that allow easy authentication of people. Outside the USA, they don't have the patriot act, but they have a lot of similar laws, and thus collecting a copy of your passport lets them know you're not an identity thief and lets them satisfy "know your customer" laws in their country. In the US the same thing can be authenticated by running a check thru a database, though in the US the law doesn't care whether you're an identity theif (which is why you don't need photographic proof) but whether you're on a terrorist list... the latter can be done just from the info you give.

They are the target of people who want to run torrent servers, criminal irc chat rooms, and stuff like that. These are not the customers they want. They also don't' want to incur the cost of setting up a dedicated server for someone whose just giving them stolen credit card info.

Since often stolen credit card info is distributed in text form, the theifs don't have access to the physical card. Showing you have access to the physical card and the physical passport does not prove that you didn't steal both from the rightful owner, but eliminates those people who just bought a list of credit card numbers.

While stolen cards are often cancelled relatively quickly, this can take anywhere from days to weeks to process thru, by which time they will have incurred the real labor costs (that they charge the 150 euro setup fee to cover) only to have those charges reversed because the card was stolen.

One thing that was illuminating for me as an american is the discovery that our banking system is set up very differently from many other countries. Thus things that are easy for us, are not as easy for them. (Taking a credit card is harder for a merchant outside the USA because the credit card system originated in the USA under the US legal structure. This is why shopping online is less common in, say, south america, than it is in north america.) Other things that are hard for us are easy for them-- if you want to give your friend $20, you just log into your bank and send him the money. The entire purpose of paypal was replaced outside the US as a simple feature on bank websites.

Asking for a photo of your passport and credit card is not really out of line. I understand why you would be hesitant to give these things up as an american-- when I first started doing business internationally, I was very hesitant as well. After awhile, though, you realize that trustworthy businesses are trustworthy. The data I'll be putting on hetzner servers is much more valuable than the image of my passport (Which every low paid border agent at a third world country I visit gets a copy of.)

If I can't trust them with my passport image, can I trust them with my data?