It's usually only reasonable to ask for a government ID, where you have already verified that in the past. Asking for it is discouraged - as that's you now hand

It's usually only reasonable to ask for a government ID, where you have already verified that in the past. Asking for it is discouraged - as that's you now handling sensitive information you should not store. You can only use what you know of the client, to verify their request. Proof of control of the only identity you have, tends to be "fair and reasonable".