You have a good point, though I _presume_ the challenge for the three digits of the PIN is made in tandem with the challenge for three characters from the passw

You have a good point, though I _presume_ the challenge for the three digits of the PIN is made in tandem with the challenge for three characters from the password (making the cracking easy but not perhaps totally hilarious). Were this not the case, I would have claimed that the number of combinations was 10^3 + k^3 rather than 10^3 x k^3. If the challenge is indeed made in tandem then the PIN is essentially just a mandatory 4-digit prefix to the password. Still, the fact that only three characters of each part is requested is essentially fatal to the security any hashing scheme, as you say. Even though this is not as ridiculous as hashing the four PIN challenges independently, which would be crackable with a lookup of amusingly-small size 1000, it still only needs a lookup of size about 700^3 =~ 350 million. This might be roughly the threshold to annoy rather than to amuse?