That's something that crossed my mind, a 4-digits PIN is a weak password by definition.
But hashing them with the customer ID, date of birth, or something else, and using bcrypt to slow bruteforce down could already be an improvement.
But hashing them with the customer ID, date of birth, or something else, and using bcrypt to slow bruteforce down could already be an improvement.
Anyway, a 4 digits pin numbers have only 10000 combinations, that can be bruteforced almost instantly.
(On the other hand, sending it by email is not a good idea.)