Just going to go ahead and assume that Air France is using this to harvest bank account pins and luggage combinations in a creative bid to ensure they meet revenue projections this year.

For a long time Schwab.com also had an absurd policy like this - but the username on the account could be 3X longer, and contain special chars...

between 4 and 6 is characters is pretty bad, but only numbers as well? Thats begging to be brute force.

Well even 4 numbers of 10,000 combinations. Say they lock the account out after 100 wrong attempts (hopefully), then assuming you don't choose 1234 or 0000 then you're pretty safe from a brute force attack.

I'm guessing they require this so you can type it in over the phone, that's the only sensible reason I can think of.

This is not safe at all. If you do this with a hundred accounts, you're likely to hack at least one.

It is safe for the individual accounts. Like a zebra in a zeal.

Lock what precisely?

If you lock the specific account from all login attempts, you have a DoS opportunity on your hands.

If you lock the specific account from specific IPs, botnets win.

And I doubt a company would have requirements like this, and cross-ip and cross-account attack validations in place.

Many companies that have heavy phone support call in usage do this, so you can easily enter the password over the phone keypad.

Verizon is the same way. 5 characters.

12345

https://youtu.be/a6iW-8xPw3k