How can companies mitigate the risks of PIN Codes guessing

So while I was driving, my wife was asked by her banking app to set up a 6 digits PIN Code. She immediately thought out loud : "Hmm... 6 digits ? I'm going to use the start of my phone number." I then remembered that I did the same thing and I just asked a friend of mine and confirmed that he does the same thing. Another friend just told me : I just use my birth date 12 / 12 / 88.

So my first question is why most apps these days have switched to 6 digits instead of 4 digits given that :

From the inventor of the ATM, a quote : The standard, ISO 9564-1, allows for PINs from four up to twelve digits. The inventor of the ATM, John Shepherd-Barron, had at first envisioned a six-digit numeric code, but his wife could only remember four digits, and that has become the most commonly used length in many places, although banks in Switzerland and many other countries require a six-digit PIN.

Second question is what can companies do to mitigate the risks of social engineering if it could be proved that most of the people will use either their birth date or phone number as a PIN code ?

• Are you insinuating that people would choose more randomized PINs if it were only 4 digits, whereas they tend to choose something memorizeable for 6 digits? If so, let me point out that I know people who use their birth date (DD/MM) for four-digit PINs, so four digits do not improve things. (Also, arguably, dates are more readily thought of as either four or eight digits these days (DD/MM or DD/MM/YYYY), but that may differ depending on the culture.) Mar 6, 2021 at 0:06
• I'm not insinuating that the 4 digits one would improve it as both 4 or 6 use the same birth date or phone number. I just find it pointless to use 6 digits if they can be misused just like the 4 digits one. My question would be what would be the best way to mitigate these risks in some way. Mar 6, 2021 at 10:42
• Don't use a numerical pin.. Numbers are sort of words represented by a single character. Memorising 6 random words is hard. With passwords (allow for more character types) it is much easier to get to 6 or more characters and still remember them. If you have to use a numerical pin, maybe show letters like classic phones so users can pretend to type words. Mar 6, 2021 at 13:13
• This question may be more suitable for Information Security StackExchange (security.stackexchange.com) because topics like social engineering which is related to UX (but outside the scope of UXSE) is discussed there. Mar 8, 2021 at 0:39

The first question is a known problem that is always contentious when balancing best security practices versus convenience for the users. There are quite a few posts on Information Security StackExchange that will be able to provide the technical details which are out of scope for our discussion.

The way the question is asked doesn't necessarily lead to a definitive answer, because different companies have varying security policies when it comes to their own data as well as the data kept for their customers/clients. However, if there is a trend of an increase in the number of digits, it is most likely to come from the fact that theoretically it increases the difficulty in brute force hacking of the PIN.

In terms of the second question, there are things that can be done from an information design perspective if the company adopts a position to increase the information security awareness of the employees (and if the employees are engage and onboard with the changes made), otherwise there's very little you can do to implement any type of changes effectively.

If people are asked to provide long numerical sequences, I would expect them to use sequences they already know.

The 'don't make me think' principle.

The answer from Michael Lai is excellent, but to build on it, the move from 4-6 doesn't as far as I know have a canonical answer, but two possibilities may include:

1. To avoid you using your bank card pin number
2. Due to common libraries making this decision and the usage of those tools becoming more prominent/unified. For example google authenticator uses 6 digits and it's one of the more prevalent tools for this kind of thing.

On the second topic, avoiding social engineering is as Michael says more an education point, but the NCSC has some useful password guidance that would apply conceptually here https://www.ncsc.gov.uk/collection/passwords/updating-your-approach particularly those around helping users create and manage passwords that are harder to guess.