I never did an ico kyc.. Come on, maybe you could send an ID card or a passport, but who stupid send selfie? I think this seller is a cheater. or any other possibility that's more likely; This vendor is the employee of an exchange. He hacked a Exchange KYC datas....
People send everything to the ICO sites which includes ID card, passport and a selfie holding the NIC etc. The ICO sites has so many real Identities which can be misused. Even they can verify their accounts at exchanges and other site using these IDs.
We should be very careful when submitting our real documents to such sites. The best option is to watermark a logo on our docs/pics stating "Only for this " etc so it cannot be used at other sites.