What shoulder surfing is
Shoulder surfing means watching someone’s screen or keyboard to pick up information, whether it is a PIN, a password, a message or a document. The name comes from the image of someone looking over your shoulder. It needs no technology at all, which is why it works in places where digital attacks would not: a train, a queue, a cafe, a waiting room, an airport gate.
Most of the time, the people who can see your screen are simply passersby with no interest in it. Occasionally, someone may be paying attention, and a quick glance at a PIN can be enough. Cameras, including those on phones, can also record screens from a distance, so it is not only the person next to you. Realistically the chance of being targeted is modest, but protecting against it is easy.
Where it happens
Think about the places where you handle things that matter.
- Cash machines and card readers, where a PIN is entered.
- Public transport, where people stand or sit very close.
- Cafes and coworking spaces, where laptop screens face the room.
- Airports and hotels, where tickets, bookings and passwords come up on screen.
- Libraries and shared computers, where the next person sits close behind you.
Steps for your PIN and password
Typing is the most sensitive moment.
- Cover the keypad with your free hand or your body when you enter a PIN at a machine or shop terminal. Do it every time, so it becomes automatic.
- Type passwords when no one is close behind you. If someone is hovering, wait a moment.
- Use a password manager or biometrics on your phone where appropriate. Entering a long password by hand in public is a bigger exposure than tapping a fingerprint or face unlock, although the real tradeoffs between phone screen locks are worth understanding.
- Check that characters are hidden as you type. Show-password toggles are useful at home but better left off in public.
- Be careful with recovery codes and one-time codes that appear on screen. Read them and enter them quickly, without leaving them in view.
If you suspect someone saw your PIN, change it as soon as you can. If you also lost a card or phone, contact the bank or carrier promptly.
Steps for your screen
Choose where you sit. A seat with your back to a wall means no one can stand behind you. Angle the screen away from aisles, windows and glass that reflects.
Lower the brightness. A dimmer screen is harder to read from a distance and from an angle. It also saves battery.
Use a privacy screen filter. These are thin sheets that darken the display when viewed from the side. They work reasonably well for laptops and sometimes phones, although they reduce brightness for you as well and do not stop someone directly behind you.
Turn off previews. Message previews, banners and pop-ups can show names and content without you opening anything. Adjusting lock screen privacy settings, and silencing or hiding notifications while you are out, means a text with a bank code does not light up for the whole carriage.
Close what you do not need. Keep sensitive tabs, documents and chats closed until you need them. An open window with an email or spreadsheet is more visible than one you open briefly.
Use do-not-disturb or focus modes during presentations or screen sharing, to stop private messages from popping up.
Lock when you stand up. Anyone can read or use an unlocked screen if you step away, so lock it every time.
On a phone
Phone screens are small and held close, so they are naturally more private, but they also get used everywhere. Consider these habits.
- Hold the phone at an angle that favors you, and avoid tilting it toward your neighbor.
- Use a short automatic screen lock so the display goes dark soon after you stop using it.
- Avoid reading sensitive messages or opening banking apps in crowded spots; wait for a quieter moment.
- Be aware that your reflection and the screen can appear in windows, so notice what is behind you.
Audio counts too
Voice can leak as much as a screen. Reading out a card number, an address or a date of birth on a call in a public space tells everyone nearby. Move somewhere quiet, or wait. If you use voice assistants, avoid speaking passwords or account details aloud near other people.
At work and when traveling
If you handle client or employer information, look-over risks matter more. Be mindful of work documents on a train or in a hotel lobby, and follow your organization’s rules on remote work. When you travel, keep tickets, passport details and booking confirmations out of sight, and consider how much your oversharing risks add up if your screen is visible for hours.
Keep it proportionate
You do not need a privacy filter, a hood and a wall behind you for every errand. A better approach is to scale the care to the task. Reading a news article does not need any, a PIN deserves a hand over the keypad, and a banking session deserves a quiet moment and a good seat. Habits you can do without thinking, such as covering the keypad and locking your screen, give you the most protection for the least effort.