Well a brute force attack usually not only depends on one machine but on a network. If the key consists of only digits thats bad to begin with because the number of permutations is rather small. Use the whole ascii set in conjunction with digits to get good protection.
Then you need to take into account network latency and server response times.
So a 16-digit key could be brute forced over internet (with current hardware) in less than a day i'd estimate.
BUT before all i don't know any serious banking system that doesn't recognize brute force attacks. They usually block the attacked account after a certain number of false login tries for a period of time or until the owner reactivates it.
Your thief must have had valid data. Block the account and reissue new keys and keep them locked tight.
Then you need to take into account network latency and server response times.
So a 16-digit key could be brute forced over internet (with current hardware) in less than a day i'd estimate.
BUT before all i don't know any serious banking system that doesn't recognize brute force attacks. They usually block the attacked account after a certain number of false login tries for a period of time or until the owner reactivates it.
Your thief must have had valid data. Block the account and reissue new keys and keep them locked tight.