Shoulder Surfing

Shoulder surfing is watching someone's screen or keyboard to see what they are typing or reading. The attacker can be standing close by, or watching from further away with a clear line of sight.

The aim is to read sensitive data such as a password, a PIN or a username as it appears on screen or is keyed in. Once the attacker has those details they can sign in as that person, and the victim has no idea their details have been seen.

Why it works

• Nothing is broken into and no software is used, so there is nothing for security software to detect.
• People often type openly in public places, in queues or in shared rooms, without checking who can see.
• The attacker only needs a moment: a PIN is a few digits and a password is typed in seconds.

Shoulder surfing is not hacking. A hacker uses technical skill and tools to break into a system, whereas a shoulder surfer simply uses their eyes, so a strong password and a firewall do nothing to stop them seeing what is typed.

Worked example

Arun taps his four-digit PIN into the keypad of a locker at a leisure centre. Someone nearby pretends to read the pool timetable but watches the digits being entered. While Arun is swimming, that person opens the locker and takes his wallet.

The same risk appears when a password is shown on a tablet screen at a busy youth club, or when a school login is displayed on a monitor that faces a corridor.