Far as I can tell, it only means the scammer was able to copy the photo that was sitting on my computer (likely via the same malware they used to steal my other credentials to begin with). Why was it sitting on my computer to begin with? Because companies like yours demand a copy of my photo ID. Sure I could delete it but we both know most people won't. IMO its a poorly thought out policy to collect photo ID without verifying the person in the photo is in fact the person you're talking to, ala face to face conversation via Skype or similar.
I don't buy things from sites that demand photo ID without verification, I'm not saying you should change your ways, but you're losing customers like me by enforcing that policy.