Original poster here. I heard back from OVH that this was their automatic fraud detection system kicking in, and after manual review they removed this requirement. Apparently I made a mistake entering my CC info. Doh...

Now I feel like I jumped the gun posting, but I also feel relieved. In any case, thanks for all the support.