PINs have been dropped for any sort of web activity, but pretty sure the PIN is still necessary for phone transactions sometimes, I think mostly with redeeming MP miles over the phone. Granted it’s been a while since I’ve done this kind of transaction on the phone, but it’s probably been within the last year, so not really that long. Not really one of those super secure systems where they get off the phone and have you type it into an automated system, but the agent will ask for it and verify before preforming the transaction.