If you knew the bank and the account, you could assume that people login to their account atleast once a month. So every month you could try a combination. Know

If you knew the bank and the account, you could assume that people login to their account atleast once a month. So every month you could try a combination. Known passcodes could be tried first. If a dump also has the person Birthday then their birth year is a good Guess for a 4 digit pass code. 2 failed attempts reset when the user succeeds their login during the month. There’s so many things people could do. Limiting passwords is a bad idea :/