I think it’s a lot simpler than that. Verifying a credit card is probably the easiest and cheapest reliable method to verify identity.

If you look at it this way: they’re trying to identify somebody, and they don’t want to do a massive amount of work in house. Do you go to a company that verifies identity? Or… you can use credit cards as a proxy for identity. Most of your users already have them.

Credit cards require no additional infrastructure, no additional corporate approval, no additional expenses, and no additional auditing. It’s good enough for the company and who cares if it’s good enough for the users.

Corporate greed is a massive problem, but you’re giving people too much credit to assume they have some kind of grand conspiracy for every decision. That requires far too much intelligence.

Corporate laziness is a far better explanation for this one.

And even better for companies: banks and credit card companies are completely unaccountable entities who've established they're willing to put up with 10000 false positives to block one false negative. They don't even have to get it right. And getting it wrong won't result in bad press or anything actionable for anyone. We're just ending up in a system where a good fraction of people are declared not people forever.