The PIN should never be transmitted over telecommunications lines in unencrypted form. If a PIN is forgotten, the customer should select a new one rather than having bank personnel retrieve the old one. Employees with access to PIN information must be subject to security clearance and must be covered by an adequate surety bond. They should not be involved in card issuance operations in any way. Determine card issuance procedures.
Ensure controls are adequate during mailing.
Determine if test or demonstration cards are adequately controlled. Ensure control over unissued Instant Issue ATM Cards is adequate. Evaluate controls pertaining to data security for adequacy. Ascertain if software access controls are adequate for the program library, data files, and network. Ensure only authorized individuals have access to the system.