Two British PhD students have designed a computer programme to crack bank security codes which potentially gives them access to hundreds of thousands of PIN numbers, it has emerged.
Armed with the software and hardware, the pair have shown that it is theoretically possible to download large amounts of confidential financial information allowing a potential thief to steal vast amounts of cash.
The two Cambridge university students plan to put details of how to crack the systems on the internet in an effort to ensure security is improved.
The security breach was revealed in last night's BBC Newsnight programme which outlined how it was possible to translate the 16-digit number for cash cards from data downloaded by the programme.
Michael Bond, 22, one of the students involved, said he felt not enough was being done to ensure that the hole in security was blocked.
"Banks' approach to security at the moment is too closed, they are relying on outdated concepts such as security through obscurity.
"What they really need to do is pay more attention to the open community including academia and get more peer review on some of the systems that they are using.
"We need to see banks being more accountable for the security of people's money."
Mr Bond said the breach could only be performed by bank staff with access to bank computers.
The system involved is based on IBM's 4758 crypto-processor used by banks, the military and governments across the world to protect their networks.
The attacks work using a combination of software developed by Mr Bond and off-the-shelf hardware costing less than £750 developed by mature student Richard Clayton.
Their research shows it is possible for a single individual, with only the level of access to a bank's computer system granted to a temporary computer contractor, to extract and download information.
Within 20 minutes it is possible to find the secret "key" from the crypto-processor it uses to scramble customer PINs.
Once taken home on a floppy disk, it would take around a day using the Cambridge equipment to reveal the secret "key".
The "key" can translate the PIN into the 16-digit number on the front of cash cards meaning a criminal could plunder thousands of bank accounts.
Alan Cox, a computer operating system developer, said: "This is a military-grade protected encryption system where you have to have licences to possess them.
"I would expect the reaction of the banking industry is probably one of pure horror... shared by the military and a considerable number of other bodies."
The students have sent their studies to IBM but claim they have yet to receive a satisfactory response to their concerns, they told the programme.
IBM said in a statement: "Normal bank practice and procedure would prevent any possibility of launching such an attack.
"This academic study is based on specific laboratory conditions. In the real world there are too many physical safeguards and authority protections for such an attack to be successful."