I may be neglecting a crucial fact here, but putting the following together leads me to believe it is dead-easy to determine a bank card's PIN using the most basic hardware available to everyone (I speak for my country in what follows):
- Each bank has an internet banking application that uses a "digipass" to verify the user. These are all made in China and there are only some models in use. It does not matter which logo or serial number is on the device, they all work the same.
- The digipass asks for your PIN, and knows if it's correct or not (quite fast).
- A regular PIN is 4 digits, making for 10000 possible codes. Brute-forcing that is easy.
Put everything together, and you get this:
- Steal a bank card,
- modify a digipass to allow for a quick succession of PIN number trials, and detect if it thinks the PIN you entered is correct (this is simple? electronics, really)
- Get a card's PIN in say, 5 seconds per try, roughly 14 hours.
I must really be missing something, or is bank card security that ridiculous?