They wanted a picture of my ID to unlock my account.

This is inappropriately invasive, and doesn’t even accomplish the stated goal, since an ID can’t prove account ownership when the account wasn’t created with an ID in the first place.

This practice has become alarmingly common for online services. We really do need strong privacy laws.