A monitoring system for an automated teller machine, ATM,, wherein the ATM comprises: a plurality of hardware devices, the plurality of hardware devices including a display device; an application layer comprising an ATM application for controlling a user transaction or interaction process of the ATM; an application program interface layer; a hardware-specific platform layer comprising hardware device drivers for controlling operation of the hardware devices; and a data store storing a plurality of screen data files, wherein the user transaction or interaction process comprising providing under control of the ATM application display data represented by the screen data files to the display device of the ATM for rendering by the display device, the display data comprises pixel data items representative of pixels representing display screens for display on the display device, and the monitoring system comprises:- a further application at the application layer; means for modifying a selected at least one of the screen data files stored by the data store to include for the or each selected screen data file an encoded identifier, the identifier being encoded on the value of at least one pixel data item represented by the at least one screen data file and identifying a display screen represented by the screen data file; and monitoring means (84, 90) for monitoring during the user transaction or interaction process the display data provided to the display device and for determining from the identifier encoded on the value of said at least one pixel data item whether the display data correspond to a predetermined display screen, wherein the further application is configured to replace or overlay said predetermined display screen with additional or alternative content in response to the monitoring means determining that the display data corresponds to the predetermined display screen. a plurality of hardware devices, the plurality of hardware devices including a display device; an application layer comprising an ATM application for controlling a user transaction or interaction process of the ATM; an application program interface layer; a hardware-specific platform layer comprising hardware device drivers for controlling operation of the hardware devices; and a data store storing a plurality of screen data files, wherein the user transaction or interaction process comprising providing under control of the ATM application display data represented by the screen data files to the display device of the ATM for rendering by the display device, the display data comprises pixel data items representative of pixels representing display screens for display on the display device, and the monitoring system comprises:- a further application at the application layer; means for modifying a selected at least one of the screen data files stored by the data store to include for the or each selected screen data file an encoded identifier, the identifier being encoded on the value of at least one pixel data item represented by the at least one screen data file and identifying a display screen represented by the screen data file; and monitoring means (84, 90) for monitoring during the user transaction or interaction process the display data provided to the display device and for determining from the identifier encoded on the value of said at least one pixel data item whether the display data correspond to a predetermined display screen, wherein the further application is configured to replace or overlay said predetermined display screen with additional or alternative content in response to the monitoring means determining that the display data corresponds to the predetermined display screen.