It is a legitimate request.
Not in the sense of "Geez dude, how could you not realize they need that?" but rather in the sense of "The credit card companies want it done even though they are skirting liability by strongly suggesting it rather than outright requiring it."
Our company just had a meeting with our bank officer and a salesman. (The bank wanting to push some new dollar-earning programs of theirs...) Nine days ago.
One thing they pushed was motivated by their approach (presented as already in place as such) to considering upon whom the crush of a fraudulent sale would fall. Basically, they said know your customer or don't do the sale because it will fall upon you from now on. Their example of a thing gone wrong was a company wanting an order of parts shipped overseas. The company itself had offices in Kentucky. Fraudulent, of course, and their idea of how that was tipped off to the seller was who in Kentucky would ever want a third-party shipment overseas? Since such a thing is entirely possible, reasonable, and a couple-of-times-a-year occurrence, their example was obviously meant to hustle us into the world of "knowing your customer" and that included getting ID.
(The company in question really did screw themselves, but with the initially presented story details and the bank's take on why the cost lay with the company, not them, it was not clear at all that the seller had been just plain stupid, so it supported my point above.)
Starting in the early 90's, asking for ANY ID to go along with the physical card was forbidden. Utterly so. (Of course, if you were sufficiently profitable, I'm sure they DID allow you to negotiate release from that.) I mentioned that and it turned out that since around 2013, they'd quietly done away with that. News to me and I've still to see their promised "in writing" documentation of the credit card companies now allowing this. But they then went back on the copy of a driver's license beat so it was very clear that allowed or not, if one did not get such, then that seller would bear the cost of fraud, not the bank.
So the website very likely was told the same thing. Given how I've seen business done over the decades, and that the OP's vendor's website clearly was told the same thing, that it really does come from the credit card companies to member banks, perhaps even with training materials (for the bank salespeople, not for dissemination to customers). Since they apparently are following the idea presented to us while almost certainly having a different bank than ours...
My thought at the time, and still now, is that obviously a miscreant (vile vermin that is) would be able to produce a document that has a fake ID at its root. (In fact, the step of "copying my driver's license" would cover the sin of the document looking like a fake since the presented copy would "be to blame" 'cause you know how copiers mess stuff up. Interestingly, many copiers have internal software to not produce any life-size copy, and sometimes any copy at all, of certain types of documents including driver's licenses.) However, it's another hurdle for some length of time, until most miscreants have software for that too.
A thought that comes to mind is that if one insisted upon a photograph, not a copy, many miscreants might forget about EXIM data and such a photo, if stored, might lead to their location and identification by cops, if cops were willing to take on such a case.
Like all security measures, it only accomplishes two things for security: as a new thing, tripping up or fully stopping miscreants for a time, and making the difficulty of achieving the theft goal harder than trying elsewhere and so pushing miscreants off to the slow runner (I don't have to be faster than the lion, just faster than you... that slow runner.) who is less work. Again, only for a time until their defeating it is pretty easy so it doesn't apply anymore.
However, in the meantime, requiring such is a way the bank people claimed would keep liability in their court, not ours. I got the impression that anything they defined as just really stupid (and greedy, or careless) would still leave you with the loss, but it wasn't explicit.
As a consumer, you have to be very concerned though, that such a photo would now be out in the world. How well do they treat such things? Is it so early they don't even have a good way to store them yet, much less a secure way? The communication that sent the copy... is it subject to a wholesale man-in-the-middle harvesting of such pictures? If such a treasure trove ever were stolen, what liability would they assume for that? If telling their industries, so an industry repository they all subscribe to is up to date, that a data breach occurred, does that repository blacklist everyone whose records were compromised? Does it share with other industries? Going along with it, having a data breach for the copies alone, so maybe no real money fraud occurring, but you getting blacklisted since your own copies in the breach are now available three for a dollar to miscreants and now you cannot do any buying on the internet at all, maybe for years... is it worth the risk of that to get today's order which might be available elsewhere instead? Individual decision time.
But from the merchant's point of view, being protected from a $400 sale suddenly being a $400 chargeback could make the decision to require such, at least from new customers, a must. Perhaps it will settle out to being only an at-sign-up kind of thing, perhaps not. But especially for companies that see a fair amount of fraud occur through them, it will be a must in some form.
I won't be indulging them myself though. Sorry Bezos the Clown, if Amazon does it, we're done. Our company won't either because we don't want the liabilities that arise from getting and storing such kinds of records. But other people and companies will make their own decisions and you'll have to expect to see it cropping up more and more.
My bet is right after getting the sale authorized so they: 1) Have you on the hook as you've put in some time and effort getting this far, and 2) You know there's now a hold on your card for the sale amount which is important in a lot of cases as now you haven't limit enough to do the sales elsewhere, and 3) They might even send the order anyway, even if you abort, and so you'd have two piles of stuff and two charges.
I imagine some businesses will also regard it as making you think you can't challenge the charges now that you've provided the DL copy. So you can't pretend there's a problem with things and that if the merchant doesn't kick in a discount, an extra or two, and maybe a credit on your site account, you'll tell your credit card provider on them. The losses to that kind of person have to be noticeable so that might seem a way to staunch the blood flow. (My wife is one of those people: in her case it's something she didn't understand or refuses to accept that it's within the expected range, gets all righteous and angry about it, and wants compensation. Never fraud, but a very disproportionate response, usually (she's dead right fairly often), to the shoddiness or other failure. Once such a warpath hinged upon the idea that something's poor packaging which did not in any way match the website's pics should be compensated for because what if she'd been buying it for a gift to someone?) Sellers bring such losses upon themselves much of the time, but this could help them to lower the cost of doing so. A valuable thing to a certain kind of vermin. So yes, it could also drive asking for DL copies, definitely.
The website was almost certainly on the up-and-up. But honestly asking because one has been instructed to by one's bank doesn't mean it's safe for the customer as the likelihood is no one really is set up yet to securely store and handle such things. One can WANT to do right a whole lot, but it doesn't mean one is CAPABLE of doing right even much at all.
We're all going to see a lot more of this as time passes into a year or two from now.
