Comment by MichaelHoste

That's something that crossed my mind, a 4-digits PIN is a weak password by definition.

But hashing them with the customer ID, date of birth, or something else, and using bcrypt to slow bruteforce down could already be an improvement.