When you initiate pick pocketing of someone you start a timer going which tells you how long you have to pickpocket before being caught. One thing with this I couldn't work out is when to stop the timer to avoid being caught.
Is there any indicator to when you should stop to maximise time available?
First of all, the timer does not show you how long you have before being caught.
Pickpocketing works like this:
The timer counting up reserves x seconds for you, this is the rummage phase. With higher pickpocket skill this timer also increases faster, e.g. it goes to 20 in the span of 10 seconds. When you stop the timer, the game pauses and you go to the pocket phase. Here can use this reserved time to reveal and steal items from the victims pockets. You also have to exit the pocket before the timer runs out. So, the longer you keep the timer in the rummage phase running, the more you can snatch out of the pocket.
You can get caught in three ways:
somebody sees you during the rummage phase. This is mostly based on your position and your stealth ability. Essentially, whenever somebody else sees you rummaging through a pocket you are caught.
the victim notices you during the rummage phase. This seems to be the meat of your question. There is NO indicator as to when the victims notices you (maybe the color of the circle is an indicator, but so far I've found no correlation). You simply have to gauge what is possible. The chance the victim catches depends on many factors: your stealth, your pickpocket skill and the victims state (alert, distracted, drunk, asleep). It can happen you get caught after one second or you can go up to 20 without issue.
the timer in the pocket phase runs out. If your timer runs out before leaving the pocket, the victim catches you. This should only happen, if you don't take enough time in the rummage phase.
A good rule of thumb for the rummage phase:
with low pickpocket skill go for 5-6 with alert people and 10-12 with sleeping ones.
When your pickpocket skill exceeds 10 you can go to 10-15 with alert people and 20-25 with sleeping ones.
Note, that 10-15 should be enough to empty out most peoples pockets.
If you want to stay safe, train extensively with Peshek to get your pickpocket up to 5-6 before trying on real victims.
Update patch 1.3:
The risk indicator is now much more precise. When green, you are sure not to get caught.
So, the green indicator should now tell you, you are safe to rummage.
I have figured it out! the persons awareness is dependent on how green to red it is the more green the more likely they are to find you out. (the colors are counterintuitive I feel) you can test this by stealing from, say, a sleeping vigilar vs a sleeping merchant.
From my experience (I'm currently playing the 1.6 version), the timer starts red, but once you've "stored" at least one or two seconds (before that, no pickpocket attempt is made), it turns green, then progressively red according to your pickpocket skill. The redder it is, the more likely the victim will notice you.
