FWIW:

She ordered a new card from Citi. It said she'd get the same account number. However, when she pushed the confirm button, the web site went weird. She waited a while (to see if there would be some confirmation), then tried again. An hour later she got two confirming emails.

She also replaced an Amex card. In that case, she immediately got a confirming email.

Citi required a security code from an automated phone call, Amex did not. Both initially offered 5-7 business day first class mail for FREE, with a link to another delivery alternative. The alternative was 1-2 business day delivery, also FREE.