I would also refuse to provide all of this information via insecure channels. You certainly can ask about the need for a passport copy being sent since that really has nothing to do with securing the payment. You can also ask to pay the balance via the same method as the deposit .. start that way at least and let them tell why it cant be done. Are you using the same form of payment as the deposit? How was the deposit received by the lodge? What kind of receipt did you receive? And upstream you mentioned the DCC issue.. how will that be addressed this time?

As you say any reasonable operator will understand your concerns and if not, I'd be a bit concerned with supplying all of my personal data.