The following situation happened to a friend of mine.

One weekend she was leaving to go to a beach resort with her husband. Because she was short of money, she asked her husband to stop at an ATM

belonging to a building society so she could withdraw money from her account. When she arrived at the ATM, she had a memory lapse and was uncertain about her PIN. She tried one number, which failed. She tried a second number, and this number failed, also. To her surprise, however, the ATM then informed her that it was retaining her plastic account card. It then provided her with a telephone number to call to report her difficulties.
Because neither she nor her husband had much cash on them and they were entertaining a guest for the weekend, she was somewhat annoyed and distressed. Upon arriving home, she called the telephone number given to her by the ATM. A recorded message asked her to state her name and telephone number and to report her problem. The recorded message also indicated that a representative of the building society would return her call as soon as possible.
Prior to calling the telephone number given to her, my friend had looked up her correct PIN in a file that she maintained. In her confusion and frustration over having lost her card, she disclosed her PIN upon reporting her difficulty. After hanging up, she realized that she no longer had her card, nor was her PIN secure.
When no one returned her call after an hour, she borrowed some money from her parents and left for the coast. On Monday morning, she was waiting as the building society branch opened its doors. She asked immediately to see the manager, and she told her what had happened. The manager then went through a tray containing some 25 cards that had suffered the same fate that weekend. She informed my friend that her card was not in the tray of captured cards. After further searching, my friend's card still could not be found.
My friend then indicated the problem that existed because she had disclosed her PIN and asked why no one had returned her telephone call. She was told it was the building society's policy to assist people on a weekend only when an ATM malfunctioned. Customers who lost their card because they had forgotten their PIN had to wait till the Monday.
Required:

a. Upon discovering her card was "lost," my friend initiated a series of steps to protect her account. What steps would you have advised her to undertake?

b. Do you think the building society's system provides reasonable protection over customer accounts? If not, what changes would you recommend, and why?