Using social engineering to bypass this is a big enough issue that even the FTC has a blog post about it [1]. It's happened to popular Youtube producer H3H3 (even with a pin) [2]. Fusion did a thing about it at DefCon this year as well, demonstrating exactly how easy it is. The whole video [3] is worth watching, but I'll like to the relevant bit.

[1] https://www.ftc.gov/news-events/blogs/techftc/2016/06/your-m...

[2] https://www.youtube.com/watch?v=caVEiitI2vg

[3] https://youtu.be/bjYhmX_OUQQ?t=98

I have many accounts that require a PIN. Many of them I set up years ago and have no idea what the PIN would be. I'm always able to talk my way out of it, though. (And this is not something I practice or know how to do well. I literally just say something like, "PIN? I have no idea. I don't even remember having the option to set one.")

Apparently, the PIN is opt-in.

>With Verizon on the phone, it was a fairly simple matter to re-reset the portal password, set an account PIN to prevent attacker re-entry and un-do the phone forward.

The problem is that the default PIN (which is what 99% of customers still have probably) is just the last four digits of the primary account holder's SSN.