http://cups.cs.cmu.edu/soups/2007/posters/p147_lim.pdf
Essentially uses an on-screen keypad that does not show the complete keypad numbers at a time. The image is refreshed at the rate of the monitor's refresh rate. Since it refreshes so quickly, our eyes can put the images together and form the keypad but for a screen capture would only capture one of the images showing an incomplete keypad. The system relies on the fact that the spyware would have to take screenshots at the same rate as the refresh rate and therefore, would consume resources and risk discovery.