Archive: Mark Rober's 2014 Demo of How Your ATM PIN Can Be Stolen

From the TI archives — originally published September 2014.

Credit-card fraud is the kind of thing you don't think about until your bank calls: charges in a state you've never visited, at a store you'd never shop at. It happens constantly. So when YouTuber Mark Rober — the ex-NASA engineer known for testing things scientifically — uploaded "iPhone ATM PIN code hack — HOW TO PREVENT" in August 2014, it was worth paying attention to.

The trick was thermal imaging. A FLIR ONE infrared attachment on an iPhone reads the heat your fingers leave on a keypad. Scan the keys right after someone enters their PIN and the thermal signature reveals which keys were pressed — and since heat fades, the brighter keys were pressed last, giving away the order too. A UC San Diego study cited in the coverage found the code could be guessed correctly about 80% of the time if the image was taken immediately, and still 50% of the time a minute later. ATM keypads, door codes, phone passcodes — all vulnerable, except metal keypads, which reflect infrared.

The prevention trick was beautifully simple: rest your fingers on the other buttons while entering your real PIN, so the whole keypad glows and nothing stands out.

Twelve years on, the lesson holds even as phones moved to face unlock. The low-tech fix beats the high-tech hack: muddy your own signal.

The original 2014 post embedded the video: Mark Rober's demo.