Well that’s a different kettle of fish. Someone could forge a charge with just the card number.
And since PINs are 4 digits long, a random run would be able to ding 1 in every 10,000 cards.
Offline, you need more than just the number to forge a card. The mag stripe data includes a CVV (card verification vector) field, which is a secret function of the card number and expiration date. Thus, you need the actual mag stripe image to make a card.
Once you've got a card with the proper mag stripe data, you can swipe with impunity at a lot of retail stores. However, some stores will ask to see the card, and the clerk will type in the last four of the account number. If it doesn't match the mag stripe, it's game over. Of course, you can emboss the card as well as re-encode the mag stripe, but that's a lot more trouble — mag stripe encoders cost about $300, but equipment to make a forgery that will pass a visual inspection is much more expensive.
Also, gas pumps around here have got into the habit of asking for your billing zip before authorizing.
For online transactions, there are other speed bumps. Namely, the billing address, which is not in the mag stripe data, and the CVV2, which is printed on the card but also not found in the mag stripe data.
In my case, there is a third speed bump. If my wallet is stolen, you still can't use my card online. That's because the billing address is a PO box which is nowhere to be found in my wallet.