Incidentally, if you think the moral of that story is that PINs are no good, you're wrong -- the real issues it exposes are that (a) banks are horribly exposed these days, and (b) any central database that is responsible for the transfer of money is a target for attacks on its authentication mechanism. (Moving to biometrics, in my view, merely creates a central authentication database full of authentication tokens that will attract criminals like a honeypot. And unlike a PIN, your bank can't issue you a new set of fingerprints or iris patterns if your biometrics are compromised.) BeLief