Upthread it was noted that you could set a PIN on FR website for your AltID. Given that AltID may be your phone number, that is not exactly rock solid security. Don't want to discover someone has drained your account
OK, so it sounds like it's the Fuel Rewards card that was used.
I can definitely see why some folks would want to set a pin. I agree, there is obviously some minor risk if it's just your phone number. If you scan your card, does it then ask for the pin, or only if you just type in your phone number?