TechKnowSurge
TechKnowSurge Catalog Videos Shoulder Surfing
VideoSecurityFree

Shoulder Surfing

Shoulder surfing is a physical social engineering technique where an attacker observes a victim's screen or keypad to steal credentials or access codes. It occurs in everyday settings like ATMs, point-of-sale terminals, and workplace environments.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Shoulder surfing is a physical social engineering attack in which an adversary observes a victim's keypad, screen, or device input to capture sensitive information such as PINs, passwords, or access codes. While many users have grown cautious of phishing emails and message-based scams, they remain vulnerable to in-person threats because proximity naturally implies a degree of trust. That misplaced trust is precisely what makes shoulder surfing effective. The attack requires no malware, no phishing link, and no technical sophistication — only a position close enough to observe what is being typed or entered. This technique appears across a wide range of real-world environments. At ATMs, an attacker standing nearby can observe a victim's PIN as it is entered. At point-of-sale terminals, a bystander may capture debit card credentials during a transaction. Even in professional settings, an IT support interaction can create an opportunity for credential theft if the technician or a nearby observer watches a user log in. The common thread is that the victim has no reason to suspect surveillance from someone physically present and apparently trustworthy. Defending against shoulder surfing requires physical awareness and deliberate habits. Users should shield keypads and screens when entering sensitive information, remain conscious of who is nearby during any authentication process, and understand that trust in a person's role or presence does not guarantee their intentions are benign. Recognizing shoulder surfing as a legitimate attack vector is the first step toward reducing exposure to it.

What you'll learn

What's covered

Shoulder Surfing

Key terms

Shoulder Surfing
An attack in which an adversary physically observes a victim entering credentials or access information by looking over their shoulder or from close proximity.
Social Engineering
A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Authentication
The process of verifying the identity of a user, device, or system.
Threat Actor
An individual or group responsible for a security incident or attack.

Topics

Shoulder Surfing Social Engineering Physical Security Credential Theft Cybersecurity Awareness

Transcript

Now, most message-based scams are well-known, and a lot of people don't fall for those message-based scams. However, they're still susceptible many times to in-person scams. They just don't believe that somebody right next to them would be trying to cheat them or trying to scam them. And that's what shoulder surfing is: when somebody's right next to you and they are secretly trying to gather some information from you.

Being in IT for most of my career, there are many times that I've hovered above people that I'm helping out with their machine, and I'm asking them to do something and they're typing in their credentials as I'm standing right behind them. There's a certain level of trust they have in me that I'm not overlooking them and recording their password or looking at their password. But this is a common way that people can get tricked into divulging information. We call it shoulder surfing.

Shoulder surfing is when an adversary spies on a user of an ATM, a computer, or some sort of electronic device in order to obtain access information.

Common Examples

A common example of this is when you're standing in line at an ATM machine to draw money out of the bank using the ATM machine. What you can do is you can overlook the other person's shoulder to see what they're typing, what their ATM code is that they're typing into the machine.

Or maybe it's at a point of sale, where you're at a business and they're using their debit card and trying to access their money that way. Or maybe it's your IT support, and you are standing over them while you're directing them through maybe logging into something and they're typing in their credentials. So now you have opportunities during those times to steal that data. Well, this is what an adversary would do.

The Attack Card

Here's our attack card for shoulder surfing. Essentially it's when the adversary is overlooking the shoulder of their victim to see what their access information is.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →