What type of attack is most likely when a token and a 4-digit PIN are used for access and the token performs offline checking?

• A. Brute force attack.
• B. Dictionary attack.
• C. Replay attack.
• D. Phishing.

Answer: (A)

Offline verification on a token means the attacker can test PIN guesses directly on the device without reaching a server. With a four-digit PIN, there are only 10,000 possible values, so the attacker can exhaustively try every option until the correct one is accepted. The lack of server-side interaction means there’s no rate limiting or lockout to stop rapid guessing, which is what makes this approach a brute-force effort.

A dictionary attack relies on using a precompiled list of likely values. While it could work for common PINs, the tiny search space (10,000 possibilities) is already small enough that trying all possibilities is effectively brute force. Replay attacks and phishing don’t apply here because the scenario centers on how the PIN is checked locally on the token rather than capturing or deceiving to reuse data or deceive a user.