Medium risk customers require less stringent authentication than high risk. PIN is preferred, but if no PIN exists, postal code alone is sufficient authentication (unlike high risk which requires both DOB and postal code). Option A is incomplete, C is not stated as medium-risk specific.