Shoulder surfing is exactly what it sounds like: someone watching your screen or your hands to steal information — a password being typed, a two-factor code on a phone, a customer record, a spreadsheet of salaries. There is no malware, no exploit, no code. The vulnerability is an unguarded screen, and the attack tool is another human being's eyes or a phone camera. It is the oldest data theft technique there is, and it thrives in 2026 because so much sensitive work now happens on laptops in cafes, trains, airport lounges and open-plan offices.
TL;DR
- Shoulder surfing is watching a screen or keystrokes to steal information, in person or via a camera.
- Classic scenes: a PIN at a checkout, a passcode on a train, an HR file in a hot-desk office, a MFA code read over someone's shoulder.
- Phone cameras make it scalable: a photo from two metres away captures a full screen.
- The fixes are habits and settings: privacy filters, lock-on-leave, awareness of surroundings, and screen lock policies.
- It belongs in security awareness training because it is the attack every employee can both commit and prevent.
What shoulder surfing means in plain terms
Every security control on your laptop assumes the person at the keyboard is your employee. Shoulder surfing attacks the assumption that nobody else can see the screen. In a crowded train carriage, a coworking space or a ground-floor meeting room with glass walls, that assumption fails.
The information worth watching is bigger than most people think: login passwords and passcodes, multi-factor codes displayed in notifications, email contents, customer data, financial spreadsheets, strategy decks, even the caller ID and spoken details of a sensitive phone call. A shoulder surfer needs patience, not skill.
It is also a component of larger attacks. A captured MFA code plus a password equals a full account takeover, no phishing required. That is why this low-tech attack pairs so neatly with high-tech ones — and why it deserves a place beside social engineering in any training curriculum: both are attacks on humans that need no malware at all.
Where it actually happens
- Public transport and cafes. The classic: an employee works on a customer database on the train, and the person behind reads names, addresses and account numbers from the screen, or simply photographs it.
- Open-plan and hot-desk offices. Screens face walkways. Visitors, contractors and cleaning staff pass behind seated employees all day. One photograph of an unattended, unlocked screen takes everything visible at once.
- Checkouts, ATMs and point-of-sale. Watching hands enter a PIN is the retail ancestor of the attack — and the reason shielded keypads exist.
- Shared video calls. A screen shared with the wrong window visible — or a colleague's screen visible behind the speaker on a home webcam — leaks what was never meant to leave the room.
- Reception areas and lifts. An employee reviewing an HR complaint on a tablet in a lift with three strangers has just disclosed it to three strangers.
The defences: habits, hardware and settings
Shoulder surfing is one of the rare attack classes where the fix is almost entirely behavioural and costs little:
| Layer | Control | What it does |
|---|---|---|
| Hardware | Privacy screen filter on laptops and phones used in public | Narrows the viewing angle so off-axis eyes see black |
| Habit | Lock the screen every time you stand up (Win+L / Ctrl-Cmd-Q) | Kills the unattended-screen photograph |
| Habit | Sit with your back to a wall; never face a crowd | Removes the sightline entirely |
| Habit | Shield keypads with your hand; use biometrics instead of PINs | Blocks PIN watching |
| Device | Hide notification previews on the lock screen | MFA codes and message previews stop displaying to bystanders |
| Office | Screen placement policy in open-plan areas; visitor screens for reception | Reduces routine exposure to passers-by |
| People | Shoulder surfing in the training curriculum | Staff notice their own exposure and say something when they see someone else's |
Two of these deserve emphasis. Notification previews: most phones display MFA codes on the lock screen, which means the code your system relies on for security is broadcast to the train carriage. Turning previews off takes ten seconds per device and closes a real account-takeover path. And the lock-on-leave habit is the single highest-value behaviour in the list — the unattended unlocked screen is the jackpot scenario every other control exists to prevent.
How to train for it
Shoulder surfing is the easiest attack to demonstrate and the hardest to excuse after the fact, which makes it ideal training material:
- Show, do not tell. In the office, stand behind a colleague and read their screen aloud from two metres. Most people are shocked at what is legible. That one demonstration changes screen-angle habits permanently.
- Teach the three-second check. Before opening anything sensitive: where am I, who can see this, and is there a wall behind me?
- Normalise the interruption. Staff should feel entitled to say "let me move" or close a laptop when a stranger lingers — without feeling rude.
- Cover the camera-and-mfa combo. Staff should know that a visible MFA code plus a known password is a full takeover, so codes are treated like passwords — never displayed, never shared, never photographed.
Cyber Aware's security awareness training covers shoulder surfing alongside the digital attack classes, because the reporting culture behind phishing reports is the same one that gets a colleague to speak up when a visitor is photographing a screen. The human risk reporting view then shows which teams retain the habit after the training lands.
FAQ
What is shoulder surfing in cyber security? It is the act of watching someone's screen, keyboard or device to gather information they have not consented to share — passwords, codes, documents or data — usually in a public or shared space, sometimes with the help of a phone camera.
Is shoulder surfing really a serious threat? Yes, because it defeats every technical control at once. The strongest password and full-disk encryption are irrelevant once the information is displayed where others can read it. It is also zero-cost for the attacker, which is why it persists.
How do I protect my laptop in public? Use a privacy screen filter, sit with your back to a wall, lock the screen whenever you stand up, and never work with customer or financial data where a crowd can see it. Ten seconds of positioning beats an hour of regret.
What is the most common shoulder surfing target? Passcodes and PINs at payment terminals and ATMs, and MFA codes displayed in phone notifications. Both are watched precisely because people assume nobody nearby is looking.
Does shoulder surfing count as a data breach? It can. If personal or health information is visibly disclosed to unauthorised people, Australian privacy law may treat it as a notifiable data breach — the same as a digital leak. The obligation does not care how low-tech the exposure was.
One last thing
Pick up any phone in your office and check one setting: are notification previews visible on the lock screen? If MFA codes pop up there, every bus ride and open-plan desk is broadcasting them. Turning previews off, and asking your team to do the same, is today's five-minute win against the oldest data breach technique in the book.