Table of contents
- What is shoulder surfing?
- How does shoulder surfing work?
- Famous cases of shoulder surfing
- Techniques to defend yourself
- Shoulder surfing is underestimated
Not all threats come from sophisticated malware or complex hacking tools. Some of the most effective attacks are surprisingly simple and rely more on human distraction than on technical skill. One such method is shoulder surfing, a form of social engineering that involves watching someone over their shoulder as they enter sensitive information.
In this article, we’ll explore in detail what shoulder surfing is, how it works, some famous real-world cases, and most importantly, how to protect yourself from becoming a victim of this often underestimated technique.
What is shoulder surfing?
To really understand what shoulder surfing is, we must start from its etymology: the term derives from the English to surf over someone’s shoulder, that is, to look over someone’s shoulder.
In common language, it may seem like a harmless or accidental gesture, but in the context of cyber security, it takes on a much more dangerous connotation.
Shoulder surfing is a social engineering technique used to obtain sensitive information simply by physically observing an individual while they interact with a digital device. The main objectives of this type of attack include:
- Passwords and PINs
- Bank account numbers
- OTP codes
- Access tokens
- Confidential business information
Advanced attackers may use technology like:
- Mini cameras
- Zoom lenses
- Drones
- Smart glasses
- Mobile phones with zoom capabilities
These tools expand the attack radius, transforming a seemingly simple technique into a highly sophisticated threat.
Real-world example: ATM scenario
At an ATM machine, a user inputs their 4-digit PIN while someone standing in line behind them discreetly watches.
The observer memorizes the PIN and later steals the card through pickpocketing or skimming. With both the card and the PIN, the attacker can empty the victim’s account in minutes.
Example: Corporate environment
A business traveler working in a shared lounge logs into a cloud dashboard using a visible username and password.
A nearby observer notes down the credentials. Later, the attacker accesses sensitive client data from a different device, possibly posing as the employee.
Code simulation: keylogger concept in Python (for educational use)
While shoulder surfing is visual, it can be enhanced with simple tools like USB keyloggers. Here’s a simulation using Python (again, for educational purposes only):
from pynput.keyboard import Key, Listener
def log_keystroke(key):
with open("log.txt", "a") as log:
log.write(str(key) + "\n")
with Listener(on_press=log_keystroke) as listener:
listener.join()ATTENTION:This code is a proof-of-concept only and should never be used in unauthorized contexts. Software keyloggers are often used in conjunction with shoulder surfing to amplify data collection.
How does shoulder surfing work?
Visual espionage made simple
Shoulder surfing works on a simple yet insidious mechanism: stealthy visual observation. No malware, exploits, or system vulnerabilities are needed. All that is needed is a keen eye, a pinch of audacity, and the victim’s inattention.
Shoulder surfers are not always hackers in the technical sense of the term. They are often ordinary individuals, perhaps not even tech experts, but who know how to exploit the environmental context — crowds, public spaces, distractions — to obtain confidential data.
Common shoulder surfing scenarios
- Subway
Someone next to you watches as you unlock your phone and memorizes your unlock code. - ATM
A person behind you notes your PIN as you withdraw money, then steals your card. - Airport
While you’re working on your laptop, a person at a higher floor captures your screen using a smartphone with zoom lens. - Café
You are accessing your bank account from a laptop. A person behind you — perhaps a pseudo freelancer with a dummy laptop — is watching the screen or recording everything with a micro camera hidden in his glasses.
Modern tools make it easier
Today, attackers enhance this method using discreet tools:
- Mini cameras hidden in watches or badges.
- Smart glasses capable of recording in real time.
- Drones used to spy from above.
- Hacked CCTV systems used to monitor workspaces or shared offices.
Victims are usually completely unaware of being targeted.
The field of shouldering computing
Shouldering computing focuses on how users interact with digital interfaces in semi-public environments and how visual threats can be minimized.
Innovative solutions include:
- Adaptive UI designs to mask sensitive fields.
- Biometric or voice-based authentication.
- Auto-lock mechanisms triggered by facial recognition.
- Randomized virtual keypads to prevent pattern recognition.
Code simulation: randomized PIN entry pad
Here’s a basic simulation in Python of a random virtual keypad used by security-conscious apps:
import random
def display_virtual_keypad():
numbers = list("0123456789")
random.shuffle(numbers)
for i in range(0, 10, 3):
print(" | ".join(numbers[i:i+3]))
if len(numbers) % 3 != 0:
print(" | ".join(numbers[9:]))
display_virtual_keypad()Explanation: Every time the user needs to enter the PIN, the interface changes the position of the numbers, making it impossible for an observer to memorize the position of the keys simply by watching the movements of the fingers.
Famous cases of shoulder surfing
Although shoulder surfing rarely appears in official data breach reports, the truth is that it has played a key role in many known breaches, precisely because it is difficult to detect and even more difficult to prove. Its effectiveness is based precisely on stealth and the possibility of going unnoticed.
Let’s now analyze three significant cases, in which this technique has allowed the theft of data, money or confidential information.
Case 1: Edward Snowden and insider access
Edward Snowden, former NSA contractor and whistleblower, famously pointed out that many leaks of classified information did not come from advanced hacks, but from simple observation — essentially, shoulder surfing.
He described how in high-security environments, simply watching colleagues input passwords or reading over their shoulders could reveal extremely sensitive data.
“Visual access in secure areas was often more powerful than technical access.” — Snowden
In response, the NSA implemented:
- Privacy filters on all monitors
- Physical cubicles and screen dividers
- Employee monitoring via CCTV
This episode demonstrated that shoulder surfing is a real threat even in the most protected places in the world.
Case 2: Street-level ATM scams in Eastern Europe
A well-documented case involves an Eastern European criminal gang that used shoulder surfing to facilitate ATM thefts. The operation was simple, but well-orchestrated:
Their modus operandi:
- One member would watch victims enter their PIN at the ATM.
- Shortly after, another accomplice would pickpocket the victim or distract them to steal their card.
- The attackers would immediately withdraw large sums, using the observed PIN before the card could be reported stolen.
This scheme has affected hundreds of tourists in European cities such as Prague, Budapest, Warsaw and Bucharest.
In many cases, the victims did not even realize they were being watched, confirming how invisible the attack can be.
Case 3: Data breaches in coworking spaces (2022 study)
A 2022 cyber security study highlighted how shoulder surfing was a rampant problem in shared workspaces.
Key findings:
- 62% of users entered passwords visibly in shared environments
- 45% accessed confidential business data with no visual protection
- 23% left their screens unattended with active sessions
Real incidents included:
- Corporate identity theft via CRM credentials
- Leaked client databases from project management tools
- Unauthorized logins to Microsoft 365 and Google Workspace
One notable breach involved a “freelancer” who snapped a photo of an open credentials file on a nearby laptop, then used it to access internal accounting data from a startup.
Techniques to defend yourself
How to protect yourself from shoulder surfing
Effectively defending yourself from shoulder surfing means adopting a combination of conscious behaviors and protection technologies. There is not a single solution, but a set of strategies that, if implemented correctly, can drastically reduce the risk of visual data theft.
Below we will explore the main defense techniques, with practical examples and – where possible – with technical support.
1. Use privacy filters
One of the most effective and immediate ways to protect yourself is to install privacy filters on your laptop or monitor. These are polarized films that block vision from lateral angles, making the screen visible only from the front.
Example
A financial consultant working on client data at a café uses a privacy screen to prevent eavesdropping.
There are also removable versions for mobile or smart workers.
2. Choose your position wisely
Avoid working with your screen facing public spaces. Sit with your back to the wall and monitor visibility angles carefully.
- Wall-facing workstations
- Corners that limit lateral vision
- Tables against walls in cafes or airports
Avoid central workstations, public benches, or “open” desks in crowded environments.
3. Enable biometric authentication
Using face or fingerprint login prevents the need to type sensitive credentials in public. It eliminates the possibility of observation and is more secure.
Advantages:
- No typing, no visual traces.
- Faster and safer in public contexts.
- Difficult to intercept even with recording devices.
4. Use password managers
Password managers offer auto-fill functions, avoiding visible input, and help generate unique, strong passwords.
- Autofill credentials, avoiding visible typing.
- Generate unique and complex passwords, impossible to remember by heart (and therefore to type in public).
- Protect credentials with a master password + 2FA.
Code example: simulated automatic login with Python and pyautogui (conceptual only)
import pyautogui
import time
# Simula l'inserimento automatico di una password
time.sleep(3)
pyautogui.write('P@ssw0rdGenerata', interval=0.1)
pyautogui.press('enter')For educational use only. Auto-fill should always be used responsibly and in secure environments.
5. Watch for suspicious behavior
Stay aware of your surroundings. If someone:
- If someone gets too close to you while you’re working, stop working.
- If you feel someone is paying too much attention, change your position.
- If you notice suspicious objects (glasses with lenses, strange badges, large watches), you may be under observation.
A webcam motion detection app can also be useful to alert you when someone is behind you.
6. Encryption and auto-lock
Even if someone sees your credentials, full-disk encryption and timeout settings help prevent unauthorized access after device theft.
Recommended tools:
- Disk-level encryption (BitLocker, VeraCrypt, FileVault)
- Automatic screen lock
- Session expiration on inactivity
Shoulder surfing is underestimated
An overlooked but dangerous threat
One of the most dangerous aspects of shoulder surfing is its underestimation. Many users believe it to be a marginal problem, relegated to extreme contexts — like spies in movies or professional hackers. Nothing could be more wrong.
Today, with the explosion of remote work, coworking spaces and the massive use of mobile-first devices, shoulder surfing is a real, concrete and daily threat.
No hacking skills needed
You don’t need to be a hacker to perform shoulder surfing. In most cases, all you need is:
- A smartphone with a good camera
- An excuse to be nearby
- A bit of patience and focus
This makes shoulder surfing a low-effort, high-reward attack — accessible to virtually anyone.
Real example: phone + zoom camera
Someone sitting behind you on a train pretends to be texting, but is actually recording your screen with a phone camera. With a 5x optical zoom, they can clearly see your email login or bank app interface.
Such scenarios are no longer rare; they’re everyday occurrences in public places.
A democratic threat
Shoulder surfing is a form of “democratic” attack: anyone can do it, wherever there is interaction between man and machine in shared spaces. It is the perfect example of how cyber security is not only a technological issue, but also — and above all — behavioral.
The accessibility of smartphones with powerful cameras and the spread of digital devices in every context make this attack more likely than you think.
Awareness is key
Understanding that shoulder surfing is real and common is the first step in defending against it.
- Always be aware of your surroundings
- Don’t assume no one is watching just because no one is close
- If you handle sensitive data, act like you’re always being watched
Even a single glance can compromise your digital life.
Questions and answers
- What is shoulder surfing?
It’s the act of secretly observing someone to steal sensitive information, usually by watching them enter it on a device. - Is shoulder surfing considered a cyber attack?
Yes, it’s a form of social engineering and is recognized in the field of cyber security. - How can I prevent shoulder surfing?
By using privacy filters, biometric logins, and staying alert in public places. - Are there known cases of shoulder surfing?
Yes, especially at ATMs and in coworking environments. - Who are the typical targets?
Anyone using digital devices in public—especially on public transport, cafes, or airports. - What does ‘shouldering computing’ mean?
It refers to the study and mitigation of visual threats in user-computer interaction. - Is shoulder surfing illegal?
Yes. It’s a violation of privacy and may be prosecuted under local laws. - Can hackers use shoulder surfing?
Definitely, though even non-technical criminals often use this method. - Are drones used for shoulder surfing?
In some advanced cases, yes. Drones have been used to observe devices from above. - How can companies defend against shoulder surfing?
By training employees, redesigning workspaces, and adopting secure devices and practices.
