The scientists took an off-the-shelf Emotiv brain-computer interface, a device that costs around $299, which allows users to interact with their computers by thought, and is often used to control games.
The scientists then sat their subjects in front of a computer screen and showed them images of banks, people, and PIN numbers.
They then tracked the readings coming off of the brain, specifically a signal known as P300.
The P300 signal is used by the brain when a person recognizes something meaningful, such as someone or something they interact with on a regular basis.
It is released by the brain around 300 milliseconds after recognition occurs, hence its name.
The team used a picture of President Barack Obama to test the readings, and saw a spike of recognition from participants.
They were also shown their home, which caused a similar reaction.
'These devices have access to your raw EEG [electroencephalography, or electrical brain signal] data, and that contains certain neurological phenomena triggered by subconscious activities,” says Ivan Martinovic, a member of the faculty in the department of computer science at Oxford.
'So the central question we were asking with this is work was, is this is a privacy threat?'
The team found they could find a person's home 60% of the time with a one in ten chance, and had a 40% chance of recognising the first number of a PIN number.
