An extremely controversial find by two University of Cambridge researchers has exposed a security weakness in the cryptographic systems used by banks to store personal identification numbers for automatic teller machine cards. The discovery is described in a February 2003 technical report, which states that the vulnerability can be exploited by malicious users to crack the PIN in fifteen guesses, on average, rather than the intended 5,000.