# How can companies mitigate the risks of PIN Codes guessing

So while I was driving, my wife was asked by her banking app to set up a 6 digits PIN Code. She immediately thought out loud : "Hmm... 6 digits ? I'm going to use the start of my phone number." I then remembered that I did the same thing and I just asked a friend of mine and confirmed that he does the same thing. Another friend just told me : I just use my birth date 12 / 12 / 88.

So my first question is why most apps these days have switched to 6 digits instead of 4 digits given that :

From the inventor of the ATM, a quote : The standard, ISO 9564-1, allows for PINs from four up to twelve digits. The inventor of the ATM, John Shepherd-Barron, had at first envisioned a six-digit numeric code, but his wife could only remember four digits, and that has become the most commonly used length in many places, although banks in Switzerland and many other countries require a six-digit PIN.

Second question is what can companies do to mitigate the risks of social engineering if it could be proved that most of the people will use either their birth date or phone number as a PIN code ?

• Are you insinuating that people would choose more randomized PINs if it were only 4 digits, whereas they tend to choose something memorizeable for 6 digits? If so, let me point out that I know people who use their birth date (DD/MM) for four-digit PINs, so four digits do not improve things. (Also, arguably, dates are more readily thought of as either four or eight digits these days (DD/MM or DD/MM/YYYY), but that may differ depending on the culture.) – O. R. Mapper Mar 6 at 0:06
• I'm not insinuating that the 4 digits one would improve it as both 4 or 6 use the same birth date or phone number. I just find it pointless to use 6 digits if they can be misused just like the 4 digits one. My question would be what would be the best way to mitigate these risks in some way. – Cristian Negraia Mar 6 at 10:42
• Don't use a numerical pin.. Numbers are sort of words represented by a single character. Memorising 6 random words is hard. With passwords (allow for more character types) it is much easier to get to 6 or more characters and still remember them. If you have to use a numerical pin, maybe show letters like classic phones so users can pretend to type words. – Martyn Mar 6 at 13:13
• This question may be more suitable for Information Security StackExchange (security.stackexchange.com) because topics like social engineering which is related to UX (but outside the scope of UXSE) is discussed there. – Michael Lai Mar 8 at 0:39