Shoulder Surfing

Shoulder surfing is a social engineering technique in which an attacker obtains information such as a password, PIN or door code by watching, or otherwise observing, a person as they enter it. Nothing is attacked or broken: the details are simply read as they are typed.

Up close or from a distance

The simplest version happens face to face: the attacker stands near enough to see your hands and the screen, waiting at the next locker while you key in a combination, standing beside you at a door panel, or leaning in to ask a question while you tap in your PIN.

Distance is no protection, because a camera can do the watching for them. Someone can prop a phone on a café table and film your fingers as though they were checking messages, or leave it recording beside a keypad nobody thought was watched. Footage can be paused, zoomed in and replayed until every digit is clear.

The weakness is you, not the system

Shoulder surfing targets what you type rather than any weakness in the software or network. Even a long, strong password is useless if someone reads it as you key it in: the attacker signs in with genuine details and the system treats them as a normal, authorised user. That also makes the attack hard to spot: there is no fake message to filter out and no file to scan, only an ordinary login by someone who knew the password.

For example, Samir pays at a self-service till and taps his four-digit PIN. The person next to him films his hand with a phone at waist height. Paused on each digit, the recording gives away the whole PIN, and Samir never spoke to anyone.