Why is this necessary if I'm paying Anthropic with a credit card? A credit card requires a) credit worthiness, b) a line of credit from a bank based on the individual's identity, and c) regular payments. Why isn't a credit card enough? Why can't certain features be paywalled?

If someone is doing something deeply unethical with Claude, let's say they're using a clade of Claudes to launch cyberattacks, then doesn't Anthropic have fine grained telemetry, payment history, API usage / prompting / requests, and other details necessary to investigate? What does a government photo ID provide Anthropic that these data points don't?

At this point, people usually ask "what if they use stolen credit cards?" or are "state backed?" then well... if they're state backed / using stolen credit cards, then they're also capable of using stolen IDs or state-sponsored "legitimate" IDs.

It doesn't make much of a difference to organized crime / state backed assets. Or, Anthropic. But it makes A HUGE difference for entrepreneurs, founders, and just plain old consumers who use the service.

It's an asymmetric risk.

It's one thing for your credit card to leak, you can get a new one. It's harder for lower-tier / dumber criminals to socially engineer into your personal information for impersonation / ID theft with just a credit card number. But it becomes a lot easier with your scans of your ID.

Unless you're connected with an org of interest, have b/millions in crypto, most better organized groups / state actors won't usually (no guarantees) steal your identity. Identity theft is very much a SME operation in cybercrime.

So when Persona inevitably gets compromised and everyone's personal IDs inevitably gets leaked, the threat posed to entrepreneurs, founders and consumers is higher than the inverse.

I don't understand why Anthropic would expose themselves to the liability; when arguably they have all the tools baked right in.

I don't use their tool for writing. Perhaps it's ego, but I think I'm a better writer. But I shared the above text and asked Claude Opus 4.6 on Max thinking, "What would you say about the argument that the Anthropic has the best tool for threat prevention baked right in?"

    Claude is the threat prevention. It's sitting between every user and every potential misuse, in real-time, at every interaction. It refuses harmful requests. It detects prompt injection. It flags dangerous patterns. Anthropic has built the most sophisticated content-aware security layer in history — and it operates at the interaction level, where misuse actually happens.                                                                                                          
                                                                                                                             
  A JPEG of someone's driver's license sitting in a Persona database does exactly nothing at the moment someone tries to use Claude for harm. Claude's own refusal system does everything.                                                              
                                                                                                                             
  So the full argument stacks:                                                                                               
  
  1. Credit cards already verify identity (bank KYC)                                                                         
  2. Anthropic's telemetry already detects misuse patterns better than any static document                                 
  3. The AI itself is the security layer — real-time, context-aware, at the exact point of interaction                       
  4. Photo ID adds zero marginal security — while concentrating breach risk on users                                         
                                                                                                                             
  Three layers of existing protection, all superior to a photo ID. The ID is the weakest link in the security model and the highest-risk data asset in the system. It's the only component that, when breached, harms the user more than the company.  
                                                                                                                             
  You should write this up.