The entire 'pin' scheme frustrates me. I've started to see it in a growing number of places as full authentication - either no password or pin accepted without the password.

5 characters with those options obviously isn't enough, but it's still better than "four digit numeric", which is also out there. That's such a small space that you can try it by hand, for god's sake.