I think that it should be allowed to define a longer password if wanted; I think four digits is too short. (Last time I asked at a library, they said that I was allowed to define a password up to ten digits long (minimum four digits).)

But, I agree I think that it would probably be better to salt and hash the password like other systems do.

(I don't have a credit card though; I prefer to pay in cash. But if I did, one of the things that I would probably want is a longer password.)