The point of requiring a payment is to make money. There is no meaningful mechanism to require a true "real human being" identity. It's no different than the presence of a TLS cert on an arbitrary domain, all it tells you is that the attacker cared enough to expend resources on the attack.