Not every threat to your passwords is high-tech. Sometimes it is just a pair of eyes over your shoulder as you type your PIN at the ATM or unlock your phone on the train. It is called shoulder surfing, and it is as old and effective as it is simple. Our GetMyPassword team explains what shoulder surfing is and how to protect yourself.
What shoulder surfing is
Shoulder surfing is exactly what it sounds like: someone watching you enter sensitive information — a password, a PIN, a card number — by looking over your shoulder or from nearby. No malware, no hacking, just observation. With a clear view, or even a quick phone photo, a stranger can capture what you typed and use it later.
Where it happens
- ATMs and card terminals, where your PIN is on display to anyone behind you.
- Cafes, libraries and coworking spaces, with screens visible to neighbors.
- Public transport and planes, where seatmates can see every keystroke.
- Crowded checkouts, where you unlock your phone or wallet app in plain sight.
How to protect yourself
Awareness is most of the defense. Shield the keypad with your hand when entering a PIN, and angle your screen away from others. Use a privacy screen filter on a phone or laptop you often use in public, and prefer fingerprint or face unlock over typing a code where you can. Avoid logging into sensitive accounts in a crowded space — and if you feel watched, wait.
The lowest-tech attack is also one of the easiest to beat: a cupped hand over the keypad and a glance at who is behind you. Biometrics help even more, because there is nothing to watch you type.
Let a manager do the typing
One of the best defenses is to stop typing passwords at all in public. A password manager fills your login automatically, unlocked by your fingerprint or face, so there is no long password to be seen. Fill your manager with strong, unique passwords from our password generator, and the most a shoulder surfer ever sees is you tapping a fingerprint — which tells them nothing.
Frequently asked questions
What is shoulder surfing?
It is when someone watches you enter sensitive information like a password, PIN or card number by looking over your shoulder or from nearby. It needs no technology, just a clear view of what you type.
How can I prevent shoulder surfing?
Shield the keypad when entering a PIN, angle your screen away from others, use a privacy screen filter and biometric unlock, and avoid logging into sensitive accounts in crowded spaces. A password manager also removes the need to type passwords.
Is shoulder surfing really a risk?
Yes. It is simple but effective, especially for PINs at ATMs and phone unlock codes on transit. Because anyone nearby can do it without tools, basic habits like covering the keypad matter.