interesting online security dilema

I recently needed to contact my super firm and get a figure. Unfortunately for me I didn't have (or for that matter even remember getting) a PIN to access their services.
Now my concern was that the PIN is something they set and you get via snail mail. Given the lack of security around peoples letterboxes, it would be easy to find out this PIN by raiding the letterbox. You get a lot of personal goodies with that PIN as well that could be useful in the wrong hands. I would much prefer a email sent to my work address, although this method has flaws as well.

I was interested that the firm chose a method that is not the 'norm'. Despite banks warning us that we should never disclose our PIN and never write it down, this firm chooses to do the opposite and write down your PIN for you. Meanwhile you have to know your member #. I assume that you can't change this pin as it's printed on a card you carry around. So what happens if your wallet/purse is stolen. There is soo much information just in that one area.
Now banks do follow a similar system where they send you a you a PIN, but it's in a seperate transaction to getting a card, and there are hoops you have to jump (ie security check) first to ensure you are who you say you are. You then need to change your PIN and not write it down.

I guess I will find out more when I get this card and can access my account. It was strange for me but maybe it's the norm for you and the companies you deal with.