Based on the understanding that credit card information has to be stored in the account and that the software service involves holding client information, option 2 should be the best option.
And I'm not sure why you have the idea that option 2 can get
annoying, and if you forget the password, it's hard to remember
when in fact I feel that most e-commerce ...
Let me preface what I'm posting with this: you are thinking that short weak passwords would be nice so that the user has a good user experience with their login. But consider the user experience if their account is compromised or the whole site is compromised - that experience is far, far worse than the minor annoyance of a more secure password.
In terms ...
Every restriction you put on passwords makes more user have to figure out a new password for your site. And make them reset it every time they try to get in and fail. And, most likely, just give up and not come back.
Your option 1 has the only restriction that makes sense, a minimum length and nothing else.
I believe normally people would assume a PIN to be an abbreviation of a personal identification number, however I think your confusion might come from how you're interpreting what personal identification means.
It sounds like your conflating a PIN with a unique identifier for a person, and whilst I can understand that logic, it's not what the personal ...