# Using birth dates or addresses in PIN codes **URL:** \ **Category:** Factual Questions\ **Created:** [January 22, 2023, 6:20pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614 "2023-01-22T18:20:57Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Knighted\_Vorpal\_Sword](https://avatars.discourse-cdn.com/v4/letter/k/ac91a4/32.png) [@Knighted\_Vorpal\_Sword](https://boards.straightdope.com/u/Knighted_Vorpal_Sword)\ **Post date:** [January 22, 2023, 6:20pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/1 "2023-01-22T18:20:57Z")
I have a relative with numerous cards - credit cards, government program cards, etc. All of these cards share one thing in common - they all have the same PIN code. Not only the same PIN code, but the 4 digit code is birthday related. My question - shouldn’t the software that is used to allow someone to pick a code also reject anything birthday, address, or phone number related? Doesn’t a code like that make it too easy to use the card if stolen or lost? ---
**Author:** ![Schnitte](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/schnitte/32/9033_2.png) [@Schnitte](https://boards.straightdope.com/u/Schnitte)\ **Post date:** [January 22, 2023, 6:27pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/2 "2023-01-22T18:27:52Z")
I’m guessing here, but I suppose the software that checks if the chosen PIN is sufficiently secure has no access to the database of personal data such as address and birthday. It would in itself be a vulnerability if it had such access. ---
**Author:** ![Thudlow\_Boink](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thudlow_boink/32/320_2.png) [@Thudlow\_Boink](https://boards.straightdope.com/u/Thudlow_Boink)\ **Post date:** [January 22, 2023, 7:13pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/3 "2023-01-22T19:13:29Z")
The fact that your relative is letting people know that their cards all have the same birthday-derived PIN strikes me as a bigger security risk than the fact that they do all have the same birthday-related PIN. ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [January 22, 2023, 7:29pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/4 "2023-01-22T19:29:36Z")
I’m not sure about that. The PIN comes into play when someone has the physical card in their possession. And your birthday is on your drivers license, which is quite likely to come into their possession at the same time. ---
**Author:** ![Procrustus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/procrustus/32/2994_2.png) [@Procrustus](https://boards.straightdope.com/u/Procrustus)\ **Post date:** [January 22, 2023, 7:38pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/5 "2023-01-22T19:38:13Z")
If most people don’t do this, a thief wouldn’t suspect you do. ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [January 22, 2023, 7:40pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/6 "2023-01-22T19:40:49Z")
But relying on psychology when you can simply not provide them with the information does not seem like a good plan. ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [January 22, 2023, 7:42pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/7 "2023-01-22T19:42:17Z")
But if some people do do it, then a thief might try this approach: First, take all the cash out of the wallet. Find an ATM, then as a first guess at the PIN, try their mmdd birthday off their driver’s license. If that doesn’t work, as a second guess try their 4-digit street address. If that doesn’t work, try 1234 and if that works withdraw as much as you can. If nothing works & the machine eats the card go steal another wallet. ---
**Author:** ![Procrustus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/procrustus/32/2994_2.png) [@Procrustus](https://boards.straightdope.com/u/Procrustus)\ **Post date:** [January 22, 2023, 7:45pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/8 "2023-01-22T19:45:28Z")
> [@LSLGuy](#): > > If nothing works & the machine eats the card go steal another wallet. Seems like a very low percentage plan ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [January 22, 2023, 7:45pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/9 "2023-01-22T19:45:51Z")
8068 is the least popular PIN. So if we all used 8068 we could put and end to this kind of fraud overnight. > **[Why Your PIN Shouldn't Be Your Birthday or a Year in the Late 1900s](https://slate.com/technology/2012/09/how-to-choose-a-pin-code-avoid-birth-date-1234-or-8068.html)** > > How easy would it be for a thief to guess your four-digit PIN? If he were forced to guess randomly, his odds of getting the correct number would be one... ---
**Author:** ![needscoffee](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/needscoffee/32/1076_2.png) [@needscoffee](https://boards.straightdope.com/u/needscoffee)\ **Post date:** [January 22, 2023, 7:47pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/10 "2023-01-22T19:47:12Z")
> [@LSLGuy](#): > > Find an ATM, then as a first guess at the PIN, try their mmdd birthday off their driver’s license. If that doesn’t work, as a second guess try their 4-digit street address. If that doesn’t work, try 1234 and if that works withdraw as much as you can. If nothing works & the machine eats the card go steal another wallet. You forgot "try ‘Joshua’ ". ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [January 22, 2023, 7:48pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/11 "2023-01-22T19:48:16Z")
> [@Procrustus](#): > > Seems like a very low percentage plan This is from 2010, but claims that 20% of people use their birthday. [One in five use birthday as PIN number](https://www.telegraph.co.uk/finance/personalfinance/borrowing/creditcards/8089674/One-in-five-use-birthday-as-PIN-number.html#:~:text=Nearly%20one%20in%20five%20card,their%20PIN%20number%2C%20research%20indicates). ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [January 22, 2023, 7:51pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/12 "2023-01-22T19:51:58Z")
> [@Procrustus](#): > > Seems like a very low percentage plan I don’t disagree. But given that you’re a thief and have someone’s wallet with ATM card, driver’s license, and perhaps a couple other cards, how do you maximize the value to you of that ATM card? Of course one can up the criminal ante by going to the address on the driver’s license, doing a home invasion, then dragging the victim to the ATM at gunpoint. But as a non-violent criminal I’d prefer a less up close and personal form of theft. ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [January 22, 2023, 7:55pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/13 "2023-01-22T19:55:22Z")
> [@LSLGuy](#): > > Of course one can up the criminal ante by going to the address on the driver’s license, doing a home invasion, then dragging the victim to the ATM at gunpoint. So maybe it’s not so dumb to use your birthday as your PIN. The pickpocket gets their money right away, no home invasions ensues, and the bank eats the loss. Or would the bank hold you liable if they checked and discovered your PIN was your birthday or 1234? I think you’d have a pretty strong case that the bank should have barred you from using it at the time you selected your PIN if they didn’t like it. ---
**Author:** ![commasense](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/commasense/32/3017_2.png) [@commasense](https://boards.straightdope.com/u/commasense)\ **Post date:** [January 22, 2023, 8:06pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/14 "2023-01-22T20:06:00Z")
Don’t most ATMs have cameras? I’d be surprised if many thieves even bother trying to use a stolen card at an ATM. ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [January 22, 2023, 8:12pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/15 "2023-01-22T20:12:34Z")
Why not just put on a hoody and mask? ---
**Author:** ![LSLGuy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/lslguy/32/5813_2.png) [@LSLGuy](https://boards.straightdope.com/u/LSLGuy)\ **Post date:** [January 22, 2023, 8:12pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/16 "2023-01-22T20:12:57Z")
My now-deceased first wife was a banking attorney. You’d be amazed at how much ATM fraud and theft goes on despite the very obvious camera staring back at you as you face the machine. Plus, at least for ATMs on bank premises, the other cameras watching the approaches to the ATM. Street criminals are many things. In general, smart and careful are not in their repertoire. Same applies for amateur 16yo delinquents with Mom’s card. Some folks do a good job hiding their face with hat & glasses & such. Most of them smile big for the camera they’re not thinking of while it matters. ---
**Author:** ![Thudlow\_Boink](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thudlow_boink/32/320_2.png) [@Thudlow\_Boink](https://boards.straightdope.com/u/Thudlow_Boink)\ **Post date:** [January 22, 2023, 9:15pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/17 "2023-01-22T21:15:32Z")
> [@LSLGuy](#): > > But if some people do do it, then a thief might try this approach: Heh heh. You said “doo-doo.” > [@LSLGuy](#): > > as a first guess at the PIN, try their mmdd birthday off their driver’s license. If that doesn’t work, as a second guess try their 4-digit street address. If that doesn’t work, try 1234 Indeed, something like one’s birth date or street address makes a very bad PIN from a security standpoint, since they are so easily guessed by anyone who has access to this information. (Although I admit I’ve done this in situations where I was required to have a PIN but I wasn’t worried about its security.) On the other hand, a PIN consisting of a random sequence of digits with no significance is also a bad idea _if_ it means you can’t remember it so you write it down and keep it with your card. ---
**Author:** ![Riemann](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/riemann/32/3133_2.png) [@Riemann](https://boards.straightdope.com/u/Riemann)\ **Post date:** [January 22, 2023, 9:24pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/18 "2023-01-22T21:24:50Z")
> [@Thudlow\_Boink](#): > > a random sequence of digits with no significance Aha! I can exclude any numbers that have any significance when I try to crack your PIN. [Interesting number paradox - Wikipedia](https://en.wikipedia.org/wiki/Interesting_number_paradox) ---
**Author:** ![md-2000](https://avatars.discourse-cdn.com/v4/letter/m/9d8465/32.png) [@md-2000](https://boards.straightdope.com/u/md-2000)\ **Post date:** [January 23, 2023, 5:31am UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/19 "2023-01-23T05:31:35Z")
> [@LSLGuy](#): > > My now-deceased first wife was a banking attorney. > > You’d be amazed at how much ATM fraud and theft goes on despite the very obvious camera staring back at you as you face the machine. Plus, at least for ATMs on bank premises, the other cameras watching the approaches to the ATM. One of my former co-worker’s wife worked in a bank. (Which annoyed him to no end because we’d all assume he as a result could answer all these bank-type questions.) She once mentioned that one of her jobs was reviewing camera footage when people disputed their withdrawals, back in the early 90’s when ATM’s first became widely available. The problems fell into two categories mainly - the client themselves, but so obviously drunk you could tell it on camera and they had no memory of that; or their teenage kids, who knew where mommy kept her cards and were smart enough to figure out the PIN - either shoulder-surfing or mommy told them because the little angels wouldn’t steal, would they? Or there was a fellow who blithely complained to us that the bank had put a delay on his deposits being accessible after he put $5 in an envelope and told the ATM it was a $50 deposit so he could withdraw $50. He didn’t see why they did that. My PIN _was_ for years the same one assigned to me randomly by a different bank when I first got an ATM card in the late 80’s. Similarly, my password for email for decades was a variation on the first Compuserve password assigned to me randomly - had to change some non-letters depending on what special characters were acceptable. I just _never_ share that. People who use something familiar remind me of the story of how people like Paris Hilton got hacked - the guy in Romania just read up about them on websites, tried all sorts of things, and allegedly then name of her dog (who appeared in many of her online photos) was her password. At the very least, add a variation of 99!$ at the end. When I was setting up usernames at my job, I used to tell people the first task was to change their password - and if they use one of their children’s names, “your other kids will eventually find out your password and know who your favourite is…” Worse yet is “Mom!? You like to dog better than me?” ---
**Author:** ![Thudlow\_Boink](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/thudlow_boink/32/320_2.png) [@Thudlow\_Boink](https://boards.straightdope.com/u/Thudlow_Boink)\ **Post date:** [January 23, 2023, 12:30pm UTC](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614/20 "2023-01-23T12:30:48Z")
> [@md-2000](#): > > “Mom!? You like to dog better than me?” Please tell me that’s a typo. > **[Urban Dictionary: dogging](https://www.urbandictionary.com/define.php?term=dogging)** > > this is where people meet up in car parks and watch eachother having sex. Sometime other people join in, but its mainly about watching and getting off on it! [Next page](https://boards.straightdope.com/t/using-birth-dates-or-addresses-in-pin-codes/978614.md?page=2)