Do PCI DSS requirements prevent processors from sending to endusers' mobile phones the PIN? I went through many PCI documents, such as the PCI security requirements 2.0 and this isn't mentioned. I'm not sure this is mentioned somewhere else, but I'd really like to have proof on that.
Assuming your question is about issuers (not processors), payment card PIN issuance is out of scope of PCI DSS requirements, however, card companies impose additional requirements and guidelines for card issuers. E.g. Visa's Issuer PIN Security Guidelines:
Ensure that PINs are protected during processing, transmission and storage by one or more of the following:
- Provision of physical protection
- Encryption of the PIN
- Use of separate HSMs for Issuer vs. Acquirer functionality
- Use of an encrypted reference or control number to indirectly link the PIN to the PAN when the two items of data must be transmitted separately.
- Issuers should ensure that their PIN management system prevents the PIN from being stored wherever it is received while under issuer responsibility. PIN mailers, SMS messages and emails are vulnerable and their content should be constructed to meet the PIN Generation, General Guidelines section.
There are different methods of sending a PIN to a user-controlled mobile device (SMS, USSD, mobile apps and so on), and with each method implementation guidelines are different. From your question it is unclear which method exactly bothers you most, but all the requirements are there in the document I've linked to above.