As if worrying about a skimming device placed on your favorite ATM isn't enough, now consumers have to think about the prospect of their very own smartphone being used to steal their personal information.

Using a program called PIN Skimmer, University of Cambridge researchers have shown that codes entered on smartphone's keypads can be identified. The software watches the user's face through the phone's camera and monitors keyboard clicks through its microphone.

Profs. Ross Anderson and Laurent Simon conducted the tests using Google Nexus-S and the Galaxy S3 smartphones.

Anderson told the BBC the researchers were surprised how well the program worked. On four-digit PINs, the program came up with the code more than half the time after five attempts. For eight-digit PINs, it was successful 60 percent of the time after 10 attempts.

While smartphones are typically PIN-protected, personal codes are often used for things such as banking apps, which the authors say raises questions of which resources should remain accessible on a phone when someone is entering a sensitive PIN.

Learn more about security.