A person shall not issue to a consumer an access device to the consumer's account for the purpose of initiating an electronic fund transfer other than: (1) in response to a request or application therefor and upon verification of the consumer's identity, which may be by any reasonable means such as by photograph, fingerprint, personal visit, signature comparison or appropriate non-documentary means; or (2) as a renewal of, or in substitution for, an accepted access device, whether issued by the initial issuer or a successor.
Massachusetts Legal Code