If a customer reports the loss or theft of an access device, should the financial institution cancel the existing card, PIN, or other access and issue a new one?

• A. True
• B. False
• C. Depends on the bank's policy
• D. Only if the PIN is compromised

Answer: (A)

When a customer reports loss or theft of an access device, the priority is to stop potential misuse by invalidating the current credential and issuing fresh ones. Canceling the existing card and PIN removes the compromised access from circulation, so a thief can’t use the card or guess the PIN to access funds. Then providing a new card and a new PIN restores secure access for the customer and prevents unauthorized transactions.

This approach isn't about weighing policy nuances; it's about immediate risk reduction. Even if you’re unsure whether the PIN is known or whether the device will be recovered, invalidating the old credentials and replacing them minimizes exposure and protects both the customer and the institution.