CC’s are an abuse prevention tool and essentially a proxy for real names since lots of companies ban “privacy” cards. Would you be willing to instead turn other proof like a government id with face recognition to auth it?

Because yeah it sucks but Heroku is shutting down their free tier because of abuse so it's not a theoretical problem. Anyone who has even more lax requirements will get run over as well.