Statistical Analysis of PIN Numbers (2012)

Interesting data, worth the read.

Of course, it is foolish to expect 4-digit PIN numbers to provide any significant level of security against a brute-force attack ordered by most common choices first. Numbers are probably the wrong tokens for PINS since they have a sequential ordering that is difficult to ignore when making "random" choices.