Security of PIN Codes
Use a randomly generated 6-digit PIN where the institution supports one, a different PIN for each relationship, and never a date. The reasoning is short.
Four digits give 10,000 combinations; six give 1,000,000. But entropy is theoretical and human choice is not: analysis of leaked PIN datasets consistently finds that a handful of patterns — “1234,” “0000,” repeated pairs, and above all four-digit years between 1950 and 2010 — account for a wildly disproportionate share of real PINs.45 Roughly a quarter of all four-digit PINs are covered by about twenty combinations. An attacker with three attempts before lockout does not brute-force anything; they try the frequency list.
Two implications. Generate the digits randomly, never by hand: human pattern-seeking ensures your sense of “not obvious” is the same sense everyone else has. And do not adopt a specific PIN because an article described it as statistically rare — publication is precisely what moves it onto the frequency lists. Finally, treat a PIN as one factor among several, never as the sole control on anything that matters.