Shoulder surfing obtains credentials or sensitive information by directly observing a target as they enter or display it — reading a PIN, password, screen, or document over their shoulder or through a camera. It is the lowest-technology gathering technique: no malware, no pretext, no message — just looking.
Wherever people authenticate in a shared space, a nearby observer can capture a PIN at a checkout, a phone passcode on a train, or an on-screen record over a seatmate’s shoulder. The camera dimension has enlarged it — a casually held phone, an overhead CCTV feed, or a pinhole camera near an ATM keypad records entries for later replay, defeating a quick glance-around. Reflections and even typing patterns extend what an observer can infer.
It leaves no trace and often serves as a precursor: a captured password feeds account takeover; captured on-screen intelligence feeds a later pretext. The leak happens because the target displayed sensitive information in a space they didn’t treat as adversarial.