# What is Shoulder surfing?

> Observing someone enter a password or PIN in person, or through a camera, to steal it.

Last reviewed: 2026-09-01

## Shoulder surfing

Category: Attacks

Canonical page: https://moolkey.com/glossary/shoulder-surfing

Shoulder surfing means stealing a credential by watching it being entered over a shoulder, through a security camera, or from across a café. Long passwords take longer to type and expose more of the entry sequence, so physical privacy matters as much as password strength here.

### Where it still happens

Cash machines and payment terminals, phone unlock screens on public transport, and shared or open-plan offices. PIN entry is the most exposed moment in most people's day, which is one reason a PIN's protection depends more on lockouts than on the number itself.

### Practical defences

Cover the keypad with your other hand to block both human observers and overhead cameras. Prefer biometric unlock in public, keeping the PIN as the fallback. Never reuse your card PIN as your phone PIN, since the phone one is observed far more often.

### Sources

- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world): Public guidance for recognizing phishing and protecting high-value accounts.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.