WHAT THE RESEARCH SAYS

Four digits,
chosen well.

A PIN is only as strong as it is unpredictable.

A hand shielding a cash machine keypad with the other hand while entering a PIN, on a quiet high street — AI-generated image, not a photograph of a real person or place.

Skip the dates
One PIN per card
Cover the keypad
Simple habits, harder guesses

Research on real bank and phone PINs keeps finding the same thing: people lean on dates and simple shapes. UK guidance adds the other half: keep it hidden and never share it.

Updated 14 October 2026

THE SHORT ANSWER

Pick it at random,
keep it to yourself.

Most guessable PINs follow a rule.
Thieves know the rules too.

DATES

Leave birthdays out

Cambridge researchers found 99% of card users carry something showing their birth date. Knowing it made a stolen card's PIN far easier to guess.

See the numbers

PHONES

Lock every device

The National Cyber Security Centre advises a PIN or strong password on each device, a different one for each, with fingerprint or face recognition as a bonus.

What to do

CASH MACHINES

Cover the keypad

UK police advice: stand close and shield the keypad with your free hand and body, so prying eyes and hidden cameras cannot see it.

Check your method

A QUICK METHOD CHECK

How did you
pick yours?

Pick the way a PIN was chosen to see how common that method was among bank customers in a University of Cambridge survey. The bar shows how much easier the method makes guessing.

Shares are of four-digit bank PINs in the survey. This is general information; follow your own bank's advice.

PIN method check

Choose a methodRandom, or the one the bank sentA dateA shape on the keypadA number pattern

Random, or the one the bank sentAbout 64%

The largest group said their PIN was random or pseudo-random. Of these, 63% kept a PIN first assigned by their bank or a previous bank.

A dateAbout 23%

Dates were the most common rule. Of date-choosers, 29% used their own birth date, 26% a partner's or family member's, and 25% a significant life event.

A shape on the keypadAbout 9%

Shapes traced on the keypad made up 8.96% of PINs. A pattern that is easy to remember is also a pattern a thief can try.

A number patternAbout 5%

Runs and repeats of digits made up 4.60% of PINs. The researchers recommend banks refuse the weakest PINs outright.

Source: Bonneau, Preibusch and Anderson, University of Cambridge Computer Laboratory, survey of 1,337 people on how they chose banking PINs (Table 2).

TWO NUMBERS WORTH KNOWING

A wallet gives
away the clue.

One figure on stolen wallets,
one on what a known birthday adds.

1 in 11–18

Wallets per successful card use

The Cambridge team estimated a competent thief would get use of a card once for every 11 to 18 stolen wallets, depending on whether banks block weak PINs.

STOLEN WALLETS · CAMBRIDGE

5.52%

Chance of guessing with the birth date known

With three tries at a cash machine, the estimated guessing rate rose from 1.44% with no clues to 5.52% when the thief knew the cardholder's birth date.

THREE GUESSES · CAMBRIDGE

The same survey found 34.3% of people with more than one PIN-protected card used the same PIN on all of them, and 52.8% had shared a PIN so someone could borrow their card.

A smartphone lying on a desk showing a blank numeric lock screen keypad, with a cup of tea beside it — AI-generated image, not a photograph of a real person or place.

FOUR HABITS TO TRY

Harder to guess,
easy to keep.

None of this needs a gadget. It is about picking a number with no story behind it and keeping it out of sight.

Change a date-based PIN
The Cambridge researchers advise cardholders never to use a date of birth. If yours is a date, ask your bank how to change it.
Use a different PIN for each card and device
The NCSC advises a different PIN or password for each device. Reuse means one guess can open more than one door.
Shield the keypad every time
Stand close to the machine and cover the keys with your free hand and body, as UK police advise.
Never tell anyone, even on the phone
Police say your bank and the police will never ring and ask you to verify your PIN. If a call asks, end it.

PHONES TOO

Longer is not
always stronger.

The NCSC suggests a 6-digit PIN or a strong password for phones and tablets, and to avoid guessable PINs. The UK government's Stop! Think Fraud campaign adds: switch on auto-lock so the screen locks when idle.

A study of 1,220 user-chosen phone PINs found that, against an attacker limited to a few guesses, people's 6-digit choices gave little or no extra security over 4-digit ones. Length helps only when the digits are unpredictable.

An open leather wallet on a wooden table holding a bank card and a driving licence, the kind of item that shows a date of birth — AI-generated image, not a photograph of a real person or place.

Questions

Questions people ask

Why shouldn't I use my birthday as a PIN?

Because it is easy to find. Cambridge researchers found 99% of card users carry something showing their birth date, and knowing it raised the estimated three-guess success rate from 1.44% to 5.52%.

Is it fine to use the PIN my bank sent?

In the Cambridge survey, PINs that were random or bank-assigned were the hardest group to guess. The risk comes from PINs chosen by a rule such as a date or a pattern.

Is a 6-digit phone PIN better than 4 digits?

The NCSC recommends 6 digits for devices. But a study of 1,220 user-chosen PINs found people's 6-digit choices gave little extra protection against a few guesses, so choose digits that have no pattern.

Will my bank ever ask for my PIN?

No. UK police say your bank and the police will never ring and ask you to verify your PIN, or ask you to type it into your phone to authorise something.

What if a cash machine looks odd?

Police advice is not to use a cash machine that looks unusual or tampered with, and to be cautious of strangers who offer to help.

Four digits,
chosen well.