A financial institution may issue an unsolicited access device (such as the combination of a debit card and PIN) if the institution's ATM system has been programmed not to accept the access device until after the consumer requests and the institution validates the device.more