[Crito]

You don't need to really brute force the pins.

What you do is you a separate list of known pins and work out the most likely pin is. Then you assume that all of your new Debit cards have that pin. Most won't have that pin, but for many of them you'll now have a working pin. For those you did not ever enter a wrong pin, so any sort of brute-force attempt detection software will never have any reason to suspect a thing.