I don't get how someone would know the second PIN is the real one. As far as they're concerned they will see 1K for the second time, which is what was shown when the distress PIN was used first. They don't know that 10K is in the account.
 
 
Wes,  I concur with Saidi. Picture this: what should be displayed if I feed in the PINs in this order; REAL->DISTRESS?
As the thug, I'd simply be on the lookout for matching results.