If a bank mails a credit/debit card in an envelope isn't there a risk that somewhere on its way the envelope will be scanned and the card number, expiration date and CVV code will be extracted?
As far as I can tell there is no protection against scanning an envelope without opening it.
By scanning I mean using light sources in order to read the numbers, the date and the CVV. I do not mean NFC scanning since that probably won't make any sense given that the cards are not activated, although it's not clear if there is an NFC attack vector here.
Even though the extracted data cannot be used immediately, once the owner activates the card there is a possibility that the data might be used fraudulently, provided that internet purchases are enabled for the card. Or am I missing something?