The software would check out your face via the camera, where it will then listen to the various clicks using the microphone as you type in the PIN number. The tests themselves were carried out on the Google Nexus S and the Samsung Galaxy S3 smartphones. According to Prof. Ross Anderson and Laurent Simon, “We demonstrated that the camera, usually used for conferencing or face recognition, can be used maliciously. The camera then estimates the orientation of the phone as the user is doing this and “correlates it to the position of the digit tapped by the user. We watch how your face appears to move as you jiggle your phone by typing.”
The microphone would see action in detecting “touch-events” as a user enters their PIN, as it “hears” the clicks which is emitted from the phone whenever a virtual number key is pressed. Brrr, scary!