This guide describes developer implementation for instant-issue cards. For general information, see <a href="doc:choose-a-card-strategy#instant-issue-cards" target="_blank">Instant-issue cards</a> in the _Choose a Card Strategy_ guide.
## Initial setup
Follow these steps to set up, create, and distribute instant-issue cards.
### Step 1: Create the instant-issue product
Set these parameters on the instant-issue product.
|CASPO||Sets a default PIN when creating an account. Can be set to No PIN, last four of mobile or home phone, or last four of <<glossary:PRN>>.|
|CBAD1||_Required_. Specifies how to include the name and address for shipping instant-issue cards. Set to `|
|EMBFL||Set only for Latin American products where a PIN-block is required. Do not set for other instant-issue products.|
|IIEX||_Required._ The number of years or days that the instant-issue card is valid. Numbers 1–5 are years and numbers 6 and higher are days.|
|IIPER||Comma-separated product IDs of personalized cards that the instant-issue card can upgrade to. Cannot be set for gift cards.|
|IITYP||_Required._ Specifies an internal process to use for this instant-issue product. Set to `|
|TEMPC||Cancels the instant-issue card when the personalized card is activated. IIPER must be set also. Do not set for gift cards.|
### Step 2: Set up the location
Ordering instant-issue cards requires that you have at least one location set up. If you already have a location 0 (root), skip this step. If you don't have any locations, call <a href="ref:post_createlocation" target="_blank">Create Location</a> with these parameters:
|`||Your organization name|
|Address parameters||Headquarters address and phone|
### Step 3: Create bulk order
Instead of embossing cards on-demand as you would with personalized cards, instant-issue cards are embossed in bulk.
Call <a href="ref:post_createbulkcardorder" target="_blank">Create Bulk Card Order</a> with these parameters:
|`||Product ID of the instant-issue card|
|`||Number of cards to ship to the location. Max: 9999. If you need to send more than 9999 cards to the same location, make additional endpoint calls.|
|`||_Optional_. String to print on the card, such as `|
|`||In-care-of name for the address where the bulk card order is to be shipped.|
|`||Street address where the order is to be shipped. Include suite numbers on this line.|
|`||City where the order is to be shipped.|
|`||State or province where the order is to be shipped.|
|`||Postal code where the order is to be shipped.|
The endpoint returns an `
order_id` that you must capture and record at this time. Galileo does not provide a way to retrieve order IDs, and you must use these IDs to get the card identifiers and perform other tasks.
The bulk card order is sent to the embosser in the daily emboss file, and the cards are embossed and shipped to the location specified. The <a href="ref:api-reference-events-api-card-shipped" target="_blank">`
SHIP: card_shipped`</a> event is not sent out for bulk card orders.
### Step 4: Get the card identifiers
To get a list of PRNs and card IDs for all of the cards in a batch, call <a href="ref:post_getbulkcardorder" target="_blank">Get Bulk Card Order</a> with these parameters:
orderId` — The order ID (`
order_id`) as returned by the Create Bulk Card Order endpoint.
returnAllCards` — Pass `
1` to get a list of PRNs and PANs. The expiry dates will not be available right after creating the order, because they are generated asynchronously by a back-end process. Ask Galileo how often that process runs in your core to know when the expiry dates will be generated.
Alternatively, you can call <a href="ref:post_verifyinstantissuecard" target="_blank">Verify Instant-Issue Card</a> for a single card. For example, if you have the card in hand you can pass the PAN in `
accountNo` to retrieve the PRN as well as other information such as the batch ID, case ID, and bundle ID for the card.
### Step 5: Enroll customer and issue card
Perform this step only for prepaid reloadable cards. Do not perform this step for gift cards.
At the store, you have an interface for customer enrollment and card issuing.
In some cases you must perform KYC/CIP on the customer prior to issuing a prepaid reloadable card. The requirement depends on the amount on the card and other factors. Consult with your bank for your specific use case. Also see the <a href="doc:customer-id-verification" target="_blank">Customer ID Verification (KYC/CIP)</a> guide.
In your enrollment interface, input the customer's name, address, and other information.
If you are required to perform CIP, input a government ID such as the SSN or whatever your bank requires.
If you are performing your own CIP, submit the information to your service and wait for the response.
If Galileo is performing CIP, go to the next step.
Call <a href="ref:post_createaccount" target="_blank">Create Account</a> with these parameters:
accountNo:` PRN of the card, as returned by <a href="ref:post_getbulkcardorder" target="_blank">Get Bulk Card Order</a> or <a href="ref:post_verifyinstantissuecard" target="_blank">Verify Instant-Issue Card</a>.
prodId:` Product ID for the instant-issue card
Other parameters as shown in the <a href="doc:create-account-procedure#parameters" target="_blank">Parameters</a> section of the _Creating an Account_ guide.
Galileo creates a customer record and associates the PRN of the card with it.
The cardholder activates the card and sets a PIN. See <a href="doc:activate-card-procedure" target="_blank">Activating a Card</a> and <a href="doc:pin-set-procedures" target="_blank">PIN-Set Procedures</a> for more information.
### Step 6: Switch to a personal product
This step is optional for prepaid reloadable cards. Do not perform this step for gift cards.
If you would like to upgrade an instant-issue customer to a personalized card, you must perform a product switch. How you perform the product switch depends on how the BINs are set up for the instant-issue and the personalized products. If the two products have the same BIN (same first six digits) follow the instructions below. If they have different BINs, follow the instructions in <a href="doc:switching-products-with-different-bins" target="_blank">Switching Products with Different BINs</a>.
Follow the steps in <a href="doc:switching-products#use-case-4-product-switch-with-new-pan-and-expiry" target="_blank">Use case 4: Product switch with new PAN and expiry</a> of the _Switching Products_ guide.
A new card is issued and sent in the mail. When the new card is activated, the instant-issue card is deactivated, as long as TEMPC is set. See <a href="doc:activate-card-procedure" target="_blank">Activating a Card</a> for more information.
Because the card has a new PAN, a new PIN must be set. See <a href="doc:pin-set-procedures" target="_blank">PIN-Set Procedures</a> for more information.
## Adding an instant-issue card to an existing user
The most common use case for adding an instant-issue card to an existing user is to provide a temporary physical card when a card has been lost, stolen or damaged, while waiting for the replacement or reissued card to be embossed and mailed.
Perform these steps when a cardholder comes to your place of business to report a lost, stolen, or damaged card.
Initiate the process to replace the card:
For lost or stolen cards follow the steps in the <a href="doc:lost-stolen-or-damaged-cards" target="_blank">Lost, Stolen, or Damaged Cards</a> guide.
For damaged cards follow the steps in <a href="doc:reissuing-cards#use-case-1-reissue-card-with-same-pan-and-new-expiry" target="_blank">Use case 1: Reissue card with same PAN and new expiry</a> of _Reissuing Cards_.
Call <a href="ref:post_addcard" target="_blank">Add Card</a> with these parameters:
accountNo:` PRN of old card
newAccountNo:` PRN of instant-issue card
prodId:` Product ID of instant-issue card
The instant-issue card is activated by the endpoint call.
The endpoint returns the `
card_id` of the instant-issue card. The PRN is the same as the lost, stolen, or damaged card.
## Fraud mitigation
All cards are vulnerable to <<glossary:BIN>> attacks, wherein fraudsters obtain your BIN and then use software to guess the rest of the digits, as well as the expiry date and <<glossary:CVV>>. When they make a successful transaction for a tiny amount, they then use the successful combination to make as many purchases as possible before you detect the fraud.
If you become aware of an attack on your BIN, you can use <a href="ref:post_modifystatus" target="_blank">Modify Status</a> to cancel the compromised accounts. However, you cannot use Modify Status on your unissued cards, because their accounts don't exist on the Galileo system yet. You have these options to cancel the unissued cards:
Provide a list of affected PANs to Galileo, and Galileo will cancel them.
Cancel the affected cards by changing their status in the <<glossary:CST>>.