The user chooses the number of digits to enter. The fact of the matter, however, is that, if you enter a good portion of your credit card number, and your computer is compromised, the numbers are right there for the taking.
Symantec suggests five or six, as a reasonable compromise between risk...