Manage Cards

Prepaid and debit cards must have a PIN set after they are issued, and the card must be ACTIVE to set the PIN. Cardholders can update their PIN after it has been initially set.

• For web-based integrations, we recommend you change a PIN with the Secure Inputs SDK.
• For native iOS and Android-based integrations, and non-native PCI-compliant environments, you can securely change a PIN from the API with a Client Token.

Use the following mutation to set a PIN for a payment card:

Once a card is active, you can provide an interface for your account holders to lock their payment card. Locking a payment card is useful for scenarios when an account holder loses their card or is not actively using their card.

You can connect the mutation SuspendPaymentCard to a toggle element in your website or application to create the lock card functionality:

You can also provide an interface for your account holders to unlock" their payment cards.

Use the ActivatePaymentCard mutation to create the unlock card functionality for your website or application:

When you reissue a card, you maintain card lineage by reusing the network-level Payment Account Reference (PAR). And depending on the reissue reason, you can either reuse or recreate the Primary Account Number (PAN) and Personal Identification Number (PIN).

To minimize the risk of fraud, you should only reissue a card that meets the following criteria:

• The original card is in possession of the cardholder, e.g., expiring/expired, damaged, or virtual.
• The original card is not subject to fraud or potentially subject to fraud.

Caution: It is a best practice to treat lost and stolen cards the same -- by breaking lineage and issuing a new card, rather than reissuing.

Stolen Cards

Do not reissue stolen cards under any conditions. When a card is stolen, our platform reports it to the payment network; so the card should not be reissued, even with a new PAN. Instead, close the old card and issue a new one to establish a new card lineage.

Lost Cards

Highnote recommends that you do not reissue lost cards as they are no longer in the possession of the cardholder, and like stolen cards, subject to fraud.

If your workflow requires that you maintain lineage for a lost card, you must:

• Set reissueReason = LOST
• Create a new PAN: copyNumber = false
• Force the user to create a new PIN: copyPin = false
• Populate cardLostDate or an API error is thrown

Contact support@highnote.com for help with lost card workflows.

Note: When reissuing a card, do not close the original card until you or the cardholder activates the new card. Otherwise, both cards may end up closed if the original card is accidentally closed before the reissued card is activated.

Refer the following table when reissuing a card:

^ Caution: Reissuing a lost card is not a best practice. Consider issuing a new card instead.

The following steps outline an example of how you reissue a card:

1. Start with an original payment card that is not in the CLOSED state.

2. Call reissuePaymentCard to create a new payment card with the same network PAR. By default, new payment cards are virtual cards and attached to the same financial account as the original card. Depending on the reissue reason, you can copy or recreate the PAN and PIN from the original payment card. You can also reissue a physical card if necessary, using an existing or new address for shipping.

3. Recreate or reuse the PAN: If copyNumber = true, the new payment card will have the same PAN as the original and you can set copyPin = true. If copyNumber = false, the new payment card will have a different PAN from the original and you must (a) set copyPin = false, and (b) update expirationDate to a new date in the future.

   Note: A new CVV is created when the PAN or expiration date changes.

4. When reissuing physical cards, the card should not be active during printing and shipping, as activateOnCreate is set to false. Even if it has the same card number, it will have a different expiration date and CVV. The virtual card remains active.

   Important: Never ship an active physical card.

5. When the physical card is delivered to the account holder, you may want to activate it. You can only maintain one active reissued payment card at a time. When you activate a reissued card, the old card is immediately deactivated and no longer accepts authorizations.

Use the reissuePaymentCard mutation to reissue a card:

Closing a payment card is permanent and closes both virtual cards and any associated physical cards. Use the following mutation to close a card:

You can view the status of a payment card, including the suspensionFlags. The suspension must be removed by Highnote if an ISSUER_INITIATED_SUSPENSION is on the payment card.

Use the following query to lookup a payment card:

Note: A maximum of 50 ATM locations are returned per request.

If you offer payment cards with cash withdrawal capabilities, you may want to provide your account holders with the ability to locate ATMs that do not have surcharges.

Note the following when using the FindATMLocationsForPaymentCardByRadius query:

• Use a radius search when searching around a specific place (address, postal code, landmark, etc.) to retrieve the locations' latitude and longitude.
• Set a distance to the radius of the search circle. The distance is expected to be in miles unless overridden.

Filters allow you to refine your ATM location search by including or excluding certain ATM features.

By default, the ATM features included are:

• OPEN_24_HOURS
• DEPOSIT_AVAILABLE
• ACCESSIBLE

Use the following query to filter your ATM search results:

When using the include parameter, ATM location search results will be filtered to only the included values of available ATM features.

In the following code snippet example, since the includes field was provided with the value of OPEN_24_HOURS, the results from the API will return only the matching locations.