On ATMs they use a keyboard with random multiple digits per key, e.g. "2 or 7", "8 or 0", etc. That's a defense to the "observing-attack", but it's slow and boring. Also, someone could unlock with other password.