What he probably meant was he hadn't memorised the PIN. Which he wouldn't needed to have done, given that as the bank admits, he never ever used the card for PIN transactions. However when he subsequently checked the number, having arrived home following the theft he saw it wasn't an "obvious" number the thieves might easily guess.
To me, the only questionable aspects are why, if he only ever used the card for telephone transactions from home, he carried it about with him, and why he ever opened the PIN notification. Had this been intact and in his possesion he would have had proof positive the PIN must have been compromised without his knowledge.
michael adams
...
This apparent