When I was at university, I went to a talk from a security researcher who found this was the case with credit cards.