This is great when the bank only has a few hundred accounts. Sure, it is unlikely to guess a single individual, but a thief probably doesn't care who they steal from.