Have a separate return mailbox for the cards or PINs to ensure they are segregated from the moment of return. Verify mailing address to your system and attempt second mailing if address discrepancy can be corrected (such as street address typo). If unable to clarify address, follow dual control destruction procedures. I would expect cards/PINs to be destroyed or remailed within 2 business days.
If you are working with a new customer this is a red flag for possible fraud, ID theft, etc. Make sure this process is tied to the appropriate security/risk management system.
Life without Jesus is like an unsharpened pencil - it has no point.