Shoulder Surfing

Shoulder surfing is the practice of stealing information by watching someone use a device — glancing at a laptop screen on a train, watching fingers on a PIN pad at an ATM, or filming a keyboard from across a café. It is the lowest-tech attack in the social engineering family, requires no malware or special skill, and works against otherwise well-defended organizations because it happens entirely outside their networks.

How it works

Opportunistic shoulder surfing is exactly what it sounds like: an observer in a public place — an airport lounge, a train, a conference — reads a screen or watches a login over someone's shoulder. Hybrid and remote work have multiplied the exposure: sensitive dashboards, HR documents, and email are now routinely displayed in cafés and co-working spaces.

Targeted shoulder surfing is more deliberate. An attacker follows a specific employee (or loiters where employees of a target company work remotely), positions themselves for sightlines, and may use a phone camera zoom or even binoculars. Video recording changes the economics: a few seconds of footage of a keyboard can be replayed frame by frame to recover a password or unlock PIN. Stolen glances also compound with physical intrusion techniques — a PIN observed at the door keypad makes subsequent tailgating unnecessary, and a name badge read on a train gives a pretexting caller instant credibility.

How to defend against it

Physical awareness is the core control: employees should treat screens and keyboards as sensitive in any public space. Practical measures include privacy filters on laptops used outside the office, angling screens away from walkways, using biometric unlock or password managers to avoid typing credentials in public, shielding PIN entry with the other hand, and locking devices the moment they are unattended. Policy should define which data classifications may be viewed in public at all.

Because shoulder surfing leaves no logs, prevention depends entirely on habit — which makes it a natural topic for scenario-based security awareness training that rehearses real situations (trains, cafés, hotel lobbies) rather than abstract rules, reinforced until screen discipline becomes reflexive.