Shouldersurfing

Shouldersurfing is the act of obtaining sensitive information by observing another person’s screen or input, typically in public or semi-public spaces. It relies on visual access to data such as PINs, passwords, passcodes, or other confidential content as it is entered or displayed. The phenomenon is a form of social engineering that exploits distractions, crowding, or the tendency to overlook nearby observers.

Common settings include ATMs, point-of-sale terminals, public computers, and mobile devices used in transit, airports, or offices. Observers may glance over a shoulder, lean into line of sight, or use reflective surfaces to glimpse confidential data. In some cases, recorded video or camera-enabled devices are used to capture keystrokes or screen content for later use.

Impact can range from unauthorized access to financial accounts to identity theft and data compromise. Victims may incur financial losses, suffer reputational harm, or face further security breaches if credentials are reused across sites.

Mitigation focuses on reducing exposure. Individuals should shield the entry of sensitive data, use privacy screens, and position screens away from nearby observers. Where possible, enable two-factor authentication, biometric logins, and automatic lock when idle. Users should log out or lock devices in public spaces and avoid entering sensitive information on devices in crowded areas. Organizations can deploy screen privacy filters, train staff on situational awareness, and implement security measures such as access controls and behavior-based monitoring.