Interestingly, for gas in Oregon you don't give a PIN#. Even if it is your bank debit card, it treats it like a credit card at the machine (meaning no pin required) at the pump. However, most of the time you do have to give your zip code. Zips are a lot easier than pins to obtain, as we all know.
I'm not on the social networks because of their flagrant abuses (and the practice is snowballing) of peoples' privacy but from what various sleuths said in Thread#1 of this case, they had so much access to Whitney's FB page that it didn't appear she was using very many controls, if any, on the site.
(BTW, even if you are ultra cautious and do lock down your social pages, and even if you never accept a single app request in all your time on there, still - ALL apps of your friends and ALL apps of your friends of friends get ALL of your personal data - even if they are some small third party fly by night working in their garage in godknowswhere. It is shocking and out of control. The US needs to more closely consider Europe's lead on privacy and the Internet. Sorry for the off-topic tributary rant on social media privacy nightmares)!
Thread#1 posters pointed out that they could glean an enormous amount about Whitney's personal life (work, home, gym, groups, friends, family, dreams, desires, worries, health, and more) just from the public settings on FB and how she uses the site. Adding: Hence, a ton of people would have access to her zip code but hardly a soul to her PIN#.