Can someone share with me what your procedures are when debit cards/pins are returned in the mail? We use an outside vendor to issue cards/pins and when they are undeliverable, they are returned to the bank. Currently we keep them for 30 days and then destroy them. However, I believe they should be destroyed immediately. I would appreciate some input on this matter from my fellow BOLers.

Thanks

The one thing I would recommend - do not keep the cards and PINs together. Very, very risky. Also, I don't think I would keep for 30 days. Maybe 14.

Have a separate return mailbox for the cards or PINs to ensure they are segregated from the moment of return. Verify mailing address to your system and attempt second mailing if address discrepancy can be corrected (such as street address typo). If unable to clarify address, follow dual control destruction procedures. I would expect cards/PINs to be destroyed or remailed within 2 business days.

If you are working with a new customer this is a red flag for possible fraud, ID theft, etc. Make sure this process is tied to the appropriate security/risk management system.