Skip to content
Submit incident
AII-1001-58041
ReportedReported by fewer than three independent publishers, with no official finding.Supporting sources are pending verification.

AI-Powered Thermal Imaging Enables ATM PIN Theft

Researchers at the University of Glasgow have demonstrated a method called ThermoSecure that uses thermal imaging cameras combined with artificial intelligence to reconstruct ATM PIN codes by analyzing heat signatures on keypad buttons. The technique achieves 86% accuracy within 20 seconds of PIN entry, with 76% accuracy at 30 seconds.

29 December 2025 Β· Security and cyberattacks
29 December 2025
AII-1001-58041
Quick facts
Category
Security and cyberattacks
Country
United Kingdom
Date
29 December 2025
Drafted by
Raidu Incident Detection

What happened

Researchers at the University of Glasgow developed a system called ThermoSecure that uses thermal imaging and artificial intelligence to reconstruct ATM PIN codes.

The system records temperature differences on ATM keypad buttons using a thermal camera after PIN entry, and AI software determines which buttons were pressed and in what order.

Reported impact

Test results showed the method achieves 86 percent accuracy within 20 seconds of PIN entry, and 76 percent accuracy at 30 seconds, representing significant fraud risk.

Security researchers noted the technology is easily accessible to criminals and provided guidance on protective measures including covering the keypad, allowing buttons to cool, using contactless payment, and inspecting ATMs for tampering.

Classification

Category
Security and cyberattacks
Industry
Financial and insurance services
Country
United Kingdom
Harm status
Potential harm
Intent
Unknown
Timing
Unknown
Harm types
Economic or property
Harmed
Consumers
Consequences
None recorded
AI systems
ThermoSecure

Sources and evidence

Sources not yet published

This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.

How sources are verifiedSuggest a source for this incident