Is it legal to withdraw funds without a PIN code?