The middleman could top-up on an empty account and see if the PIN work.
Not looking for much btw.