Aeromexico did the same thing to me. Long story they screwed up my ticket and I had to buy a ticket and they’d reimburse me. It actually happened (through dogged persistence and front-end planning on my part), and at the final step they asked me to send them a pic of my CC and ID for confirmation by replying to that email. I asked for a secure website to submit it to and was told the process was to email it. So I sent an encrypted, password-protected PDF and it was stripped from their system. After several days of debate I tried to send the PDF again and it went through that time. Airlines seem to have no issue asking for your most personal details over insecure means.