On SIM cards, which are used in mobile telephony, PIN (and PUK) is used. Unlike a password, they are locked after some incorrect attempts to prevent brute force attack. If wrong PIN is entered 3 times, user must enter PUK. When wrong PUK is entered 10 times, SIM card is permanently disabled.
On the website, if wrong PUK is entered 10 times, user must contact customer support to unlock their account. To prevent abuse, user must enter their password first.
Will adding PIN/PUK as second password increase security? Should it be added?