Yeah, but then you have to make the lookup anyway, to check if they did change it. You might as well just authenticate. Unless the original PIN always works, which is not secure.