Analysis of bank PIN numbers

Thank you very much for this information. I was wondering.

Yeah, 5555 sounds like hahahaha in Thai :)

Interesting. When you say 1004 'sounds like angel', do you mean saying 'one thousand and four' in Korean sounds like cheonsa? or 'one zero zero four'? Or the numbers look like letters than spell out angel? / tangent

You can't change your card's PIN? That's news to me.

that's an interesting article that shows the difference between markov and monte-carlo approaches, but it seems to be incomplete. in particular, although it claims it will calculate an exact solution (just after the "Markov Chains" subtitle) it never does; the example uses repeated calculations and stops at some point to give an approximate answer. am i misunderstanding something?

In Finland you actually don't get to pick your own PIN. The bank sends one to you when you get a new card and that's that.

Many banks apparently don't let you choose PINs; however from the limited sample of PINs I know of (mine, my wife, my company and a few others) they're not random; they all have doubled digits (like 2554).

In the UK, cards are issued with random PINs. I believe some have the facility to change them, but i would guess the majority do not. I was wondering this when reading the article; so I can take it to assume that in the US you define your own pin? How does that work, do you do it at the bank or a the ATM machine the first time you use it?

I opened an account at Citizens Bank, who did not let me choose my pin code. It went something like this.

Received card, no pin, called, sent new, recieved card, no pin, pin came 2 weeks later.. for the first card, no pin for second card, third attempt nothing was sent, went to the bank, they told me I had to call, gave up after 2 months, over the next year they sent me several new cards (security breaches?), but I never had a pin to activate them.

One year later they change their terms and contions, impose new fees, deplete my checking account, deplete my savings overdraft account, and then send me to collections... all for opening a couple of accounts and depositing a few hundred dollars.

I know it is best to use a full uniform distribution for assiging PINs, but I do not know whether any bank does it. Would they really dare send out '0000' to 1 in 10000 of their customers?

>And why do banks (or credit card companies) even let users pick their own PIN codes?

Sure the PIN sucks, but ATM security is actually two factor, something you have and something you know. The cards can be duplicated, they've made good inroads on that but haven't rolled those cards out in the states.

Its an example of "good enough" security. Not only is the barrier to theft much higher than the cash next to it in their wallet, you only have a 30% chance of getting into their account before the ATM eats the card. If you do get in, you can typically only withdraw $300 and your face has been recorded.

Which kinda sucks that security is compromised to make more profit.

I find it kind of strange that you're picking up on this, do you not read everything on HN as a stream of soul-crushing money-first attitudes too?

Additionally, if I'm reading this properly, it only includes people who chose numeric passwords when they could have chosen anything (presumably beyond alphanumeric even). This means that all of the folks who chose a password outside of the PIN domain (presumably because they know better) don't have their PINs represented here, and I'd wager that a better proportion of those numbers are beyond 1234, 0000, etc..

My buddy gave me his card yesterday and asked me to go to the ATM for him.

His PIN? 4321

Here in New Zealand banks reject sequential and repeating numbers for your PIN, and they also check for your birthdate.

So the trick is to find their anniversary or first child's birthday.

I've been using 10 in Canada for several years now. I initially carried cash on me as I expected it not to work at a lot of places... So far I've only had one issue which was at a parkade. The payment machine only accepted six digits on debit cards.

This happened to me, too. For once, carrying travelers checks came in handy.

In Turkey, most ATMs accept my extra-long PIN, but very few have UIs designed to fit more than 4 digits. On many of them, the digits will continue outside of the form field and sometimes all the way off the screen.

Did machines just reject your pin, or did they accept the first 4-6 digits?

I don't get why banks restrict the number of digits of a pin. The bank I'm with limits your pin to 4 digits.

Is it a usability issue, or don't they realise that more digits means more pin options?

I ran into the same issue while traveling in South America. Some ATMs would not work at all with my 8+ PIN.

Strangely, there was one ATM that accepted 4 digits and then automatically continued to verification of the PIN. I never got a chance to enter the rest of the digits, but it still passed verification and allowed me to withdraw.

On the other hand, my bank only allows 4, and when I go overseas, I sometimes can't use my card at all because they require at least 5/6/8.

In this case it actually works because he's looking at the 'numbers behind the PINs' :)

Blame the people who coined the initialism, not the public who uses it the way that sounds best.

I just call them PI /pɪ/ numbers!

  > but I highly disagree with that extrapolation.

That's great, but your counter-claim isn't obvious at all. So please elaborate. Are you alluding to banks generally setting people's PINs for them, using more appropriate distributions? Or, God forbid, do you believe that users are more careful when picking sensitive PINs?

I have serious doubts about the latter.

As supporting evidence, the author points to the high frequency of "2580", which is vertically down on a numeric keypad but not on a computer keyboard. That dissuades me from accepting your high level of disagreement.

The naming of Benford's Law has long bothered me. It feels to me like it should be Benford's Observation. Awesome catch, though! I love it.

The humans aren't being random. They're using numbers from sources in real life. A large fraction of the data points are years from the twentieth century as 19xx and a smaller fraction as 200x. MMDD or DDMM format dates also follow the Law in tending to lead with digits 0-3. Or consider the 2580 case or other patterns on the keypad, where the leading digit will skew towards the beginning of the digit-alphabet.

So Benford's Law will apply even on a data set that has no numerical meaning in itself, transitively from the real sources of the numbers.

Thanks for sharing.

Last time I signed up to a new bank there was a box on the paper form for your pin number, which was then typed in a clear text field by the staff member setting up my accounts.

I stuck with my old bank who used a secure entry keypad so I could set my pin.

The only thing I could think of was Ubuntu version 10.04. I doubt that explains it. I thought any variation on that (1.004, 10.04, 100.4) might have some significance in popular culture, like the 42 has, but didn't find anything.

I'm curious.

In Spain, 1004 is the number to call the main phone company. It is usually associated to something bad, as you can imagine :-P but it is an easy 4 digit number to remember. Not sure if that is the case in other countries...

I still prefer the korean explanation, though

In Sweden I've had pins without duplicated digits.

As 'finnw has mentioned, almost 50% of 4-digit numbers have at least one repeated digit, so there is high chance of ending up with such a number. FWIW I have 2 UK cards from different banks where the PIN has no repeated digits. I suspect you're seeing a pattern where there is none.

Incidentally, codes with repeated digits make it harder to guess your code based on fingerprints, as there are more possible combinations.

It's called the birthday paradox :)

4960 of 10000 4-digit numbers contain at least one duplicate. Also, the probability of getting a number that has an unusual property is, counterintuitively, as an old math joke states, 1.

1/3 of mine have duplicated digits.

And now all the hackers that care have inverted the map and are attacking you with the inverted version now :P

Backwards birthdays, like 2311 for November 23. In Europe this would be the usual way of writing a birthday already.

Now the world knows :)