[benvd]

If enough people never bother to change their PIN, it might still be worth it.

[StavrosK]

Yeah, but then you have to make the lookup anyway, to check if they did change it. You might as well just authenticate. Unless the original PIN always works, which is not secure.