[nobodyshere]

You also forgot to mention multiple cards and pins people have / used to have. I'd expect a false trigger in the system in that case.

[PeterisP]

You get a bunch of positives and check/bruteforce afterwards. This system couldn't distinguish my creditcard PIN from my office alarm PIN code, but it can give a shortlist to try.