According to a University of Cambridge study, somebody who steals wallets can guess a PIN correctly on every 18th card they try. And it’s even easier when banks let cardholders select their own PIN.