The pin isn't the security, your physical card is. Pins are usernames, cards are passwords.
The account number is the unique identifier assigned by the bank. Your card is the physical "key" (password) to said account, and the PIN is your self chosen identifier (username).
Think of it this way: I can tell you my pin number and my bank account number all day long, it doesn't matter if you don't have my card. But if you had my card, you'd have a reasonable shot at guessing the PIN and gaining access. The card is the password.
Despite the misnomer, a PIN can't really be an identifier if you and I have the same one.
Sure it can, the namespace is just within your account.
I am logging into account X (account number) as Person Y (PIN) with authorization Z (card)
A PIN is a password, not a username.
Which is no longer true for EMV cards, though. There, the chip contains some additional data which cannot be easily copied and which helps identify the card as a bona fide real card issued by a bank.
https://www.emv-connection.com/contact-chip-card-online-auth... (there's also some alternative authentication method that would work offline, i.e. just between the card and the payment terminal)
Or more like PIN is that password, and the card is the token.
Username and password are both something you know, so they count as just one factor. A card on the other hand is something you have, so combined with the PIN that's two factors.