What it means
When you use a payment card at a cash machine or shop terminal, the card proves that you possess the card and the PIN proves that you know a secret. Having both is much harder for a thief than having only one.
This idea, that you must show something you have and something you know, is the basis of many security systems. PINs are short because people have to remember them, and that is also their weakness.
A four-digit PIN has only 10,000 possible combinations, so a thief with unlimited attempts could find it quickly. Banks defend against this by locking the card after a few wrong tries, so only a handful of guesses is possible.
Behind the scenes the PIN is not stored in plain form. It is checked using encryption (scrambling data with a secret key) inside secure hardware, so staff cannot read it.
When a chip card is used, the PIN can be verified by the chip itself, which makes copying the card far less useful. For businesses the PIN affects cost and risk.
Card agreements often set out who bears the loss when a PIN-protected card is misused, so a cardholder who shares the code can end up responsible for the loss. Companies also use PINs for internal systems such as payroll terminals and access control, where the same rules of secrecy and lockout apply.
The nuance is that human behaviour is the weak link. Many people choose birth years, repeated digits or simple sequences, and thieves know the most common patterns.
Good practice is to use a number with no personal meaning, never to share it and never to write it on the card.
In practice
Real-world examples.
Example
A shopper pays for $85 of groceries with a debit card. She enters a four-digit PIN on the terminal, which proves she is the cardholder, and the payment is approved without a signature. The whole process takes a few seconds. If she types the wrong number, the terminal asks her to try again.
Example
A finance team sets up a corporate bank token that requires a six-digit PIN each time a payment batch is approved. This prevents a stolen laptop from being used to release payments. The treasurer also sets a limit on how many wrong attempts the token allows.
Example
A retail manager trains new staff never to ask customers for their PIN or to look at the keypad. A customer whose PIN was seen by a stranger is advised to change it immediately. The manager also keeps terminals positioned so that screens and keypads are not visible to other people in the queue.
Formula
Calculation
Number of possible PINs = 10 ^ number of digits
Chance of a random guess succeeding = number of guesses / number of possible PINs
A four-digit PIN has 10 x 10 x 10 x 10 = 10,000 possible values. If a card allows 3 attempts before lock-out, the chance that a thief guesses correctly by chance is 3 / 10,000 = 0.03%. A six-digit PIN has 10 ^ 6 = 1,000,000 values, so the same three attempts succeed with probability 3 / 1,000,000 = 0.0003%. The extra two digits make a random guess 100 times harder.Case study
Seen in the real world.
Greenway Credit Union is an illustrative, fictional lender with 60,000 members. An internal review found that 4% of members used a PIN that matched their birth year, which made those cards easy to guess if lost.
That was 60,000 x 0.04 = 2,400 members at higher risk. The credit union began prompting these members to change their PIN, blocked the most common patterns such as 1234 and 0000 for new PINs, and educated members about shoulder surfing.
Over the following year, fraud on lost cards fell by about a third, saving the credit union an estimated $90,000. The illustrative lesson is that a weak human choice can undermine a strong technical system, and simple rules can make a measurable difference. The credit union now repeats the campaign each year and tracks the share of members with weak PINs.
Watch out
Common mistakes.
- Choosing a PIN based on a birthday or a simple sequence, which thieves try first.
- Writing the PIN on the card or storing it in a phone note next to the card details.
- Sharing the PIN with a family member or colleague, which can make the bank treat any loss as the cardholder's responsibility.
Questions
People also ask.
Is a longer PIN safer?
Yes, each extra digit multiplies the number of combinations by ten, although a longer PIN that follows an obvious pattern is still weak.
What should I do if someone sees my PIN?
Change it as soon as possible, and tell the bank if you suspect your card was used or taken.
Why do banks lock a card after three wrong attempts?
The lock-out limits the number of guesses, so a thief cannot try all 10,000 combinations of a four-digit PIN.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related