Is it a bad idea to make multiple SHA-* with the same header? I'm trying to figure out a simple way to verify ownership over a short period of time (typically 8 - 24h), to be used in a mobile application.

One of the ideas I came up with is to hash the following concatenated sequence:

user pincode + user unique ID + payload
where
    pincode   is a 6 digit passcode, provided by user
    unique ID is a GUID identifying the device, generated once
    payload   is a rather long JSON payload, different each time


Provided I'm using an algorithm like SHA-512 or similar, what's the risk of using always the same header (pincode + ID) for multiple hashes?

Is it easier for an attacker to figure out a header if used for multiple hashes?

Optionally, do you think this would be a valid ownership verification, knowing an attacker could potentially replicate a payload.
The standard assumption in cryptography is that the adversary knows


methods used
what's physically transmitted (here, I guess payload and the SHA-512 hash);
any data other than the key(s)


Here pincode is clearly a key, and the default assumption would be that unique ID is not. With this hypothesis, a single hash is enough to allow an adversary to find pincode by enumeration, then break the system. Thus multiple hashes are not worrying, but the basic principle is insecure.

Additionally, SHA-512 is vulnerable to a length-extension attack, and with a few hypothesis about what's admissible as payload, that might allow computing the hash for an extension of the payload, without knowledge of unique ID (or even the original payload; only its length is required).

If some other hypothesis applies, please edit the question.