QC? 4-digits pin? What does one have to do with the other? The pin would be trivially brute-forceable if it wasn't rate limited - 3 intents and you're out.