Yes you are right. I made a lot of KYC for ico's or bounties and its scared me to give my passport copy to unknown person or company.