The german brank credit report service "Schufa" uses a so called "SuperPIN" to enable users to reset their password. This super pin is a permutation of 30 lower and upper case letters and digits and is snail mailed to the user at registration.
To reset the password the system selects two positions and requests the characters at those positions.
I wonder how safe this system is against attacks to the server. The superpin cannot be stored salted and hashed because the server needs access to every individual character. Hashing and salting the character at every position (or all the 870 pairwise combinations) would not resist a brute force attack against the hash either.
From this facts I cannot derive an advantage over snail mailing a reset code to the user. What did I miss?