Where I am, PIN and Card arrive in different letters, and the Card letter is only sent once you confirmed via your online banking interface (which uses 2FA) that you received the PIN letter. And you need to confirm online in your banking interface to have received the card to be able to use it.
Require the customer to verify that he/she received the card in their online banking interface.
Mark it as invalid/stolen/whatever before that.
I'd like a chip card that requires a PIN (and that is accepted widely in the US) because such a card would make unauthorized charges less likely after the card is lost or stolen, but was not able to find one.
If the attacker already has access to the online banking account, then he/she can do much worse things anyway.
I don't know if this is now normal in the UK. The previous time I opened an account in-branch was 2004, when the chip card arrived by post a few days later, with the PIN in a separate letter.
In fact, I’ll go next friday to the bank to get a new debit card, as my existing one stopped working a few months ago.
And it only delays the process by 2 days. At maximum.
The fact that you can even say "well it's only 2 days delay" seems insane to me.