[joecurry]

He's not presuming the PIN is ON the card, but that the transaction was the point of compromise (i.e. you punching in your PIN and the software running a verification of if that PIN is correct).

[jakewalker]

Ah - that makes more sense.