Probability Theory for Pickpockets— ec-PIN Guessing

This abstract briefly describes an algorithm for determining the most likely 4-digit PINs associated with a debit card used at EuroCheque (ec) ATMs. We determine the probability of every PIN based on knowledge of the PIN-generation method and the data on the magnetic stripe. A card thief could use this strategy to optimally select the three PINs that he can try on a stolen card before it will be invalidated. The analysis shows a significant security problem of the PIN-generation algorithm, which allows the presented PIN-guess strategy to achieve a considerably higher success rate than a random guess would. The reader is assumed to be familiar with basic probability theory. The analyzed PIN-generation algorithm has been used by German banks from 1981 until 1997 according to documents available to the author.