Right but -- the attack vector is different. Scan/parse 10000s of JPG, and all that jazz -- to get identites. Not Trivial. Or if the hotel stored the copy as a physical photo copy -- you're not bulk scanning 10k pieces of parchment at super speed for your identity-theft ring.
But download JSON blobs? From 10k records the hotel didn't store properly (cause they are not IT experts, or don't have experts at close hand) -- if you get in to their system the JSON is loads easier to parse than the JPEG.
Methods for KYC could(should!) be improved.
But like one of the Identity team folks said, the hotel would only have the OPTION to download and store those blobs. They aren't required to, and I'm assuming they would not. They'd be happy with the verification result and letting Stripe handle storing the PII.
Speaking from experience as we use Stripe Identity, and love not having to store the PII.
Isn't the problem that businesses are required to store this type of information (kyc verification information)? At what point are we going to have a logical system for verifying identity that doesn't require transferring the same list of data that every other 3rd party you've verified with also has?
They are both toxic, IMO. Businesses need to stop relying on this stuff.