If a customer reports the loss or theft of an access device, which action should be taken?

• A. Cancel the existing card, PIN, or other access and issue a new one
• B. Do nothing until the next update
• C. Change only the PIN
• D. Issue a new card without canceling the old one

Answer: (A)

When a customer reports loss or theft of an access device, the priority is to prevent unauthorized use by immediately invalidating the current credentials. The right action is to cancel the existing card, PIN, or other access and issue a new one. This ensures the compromised device cannot be used to access funds or systems, since the old credentials are revoked and a fresh credential is issued to the customer. Simply changing the PIN or issuing a new card while leaving the old one active creates a window where the stolen device could still be used, which is why those options are not secure. After canceling and reissuing, verify the customer’s identity, provide the new card and PIN, and remind them to destroy the old card securely and to report any further suspicious activity.