Shouldering is observing a person's private information over their…

The idea

Shouldering, often called shoulder surfing, is a social-engineering technique in which an attacker directly observes a person's private information by watching them. The attacker stands or sits close enough to see a screen, keypad or written note. A classic example is watching someone enter their PIN at a cashpoint machine; the same risk applies at a card reader in a shop or when typing a password on a laptop in public. The key features are direct observation, the victim's private information as the target, and physical proximity rather than any software. Defence includes shielding the keypad with your hand or body, checking who is nearby and avoiding entering sensitive data in crowded places.

What earns the marks

• Defines shouldering as observing a person's private information by watching over their shoulder or from nearby.
• Identifies the target as private information such as a PIN or password.
• Gives the cashpoint machine PIN example as stated in the specification.
• Recognises that the attack relies on physical proximity and direct observation, not software.
• Suggests a sensible defence such as shielding the keypad or checking for onlookers.

Common mistakes and how to put them right

• Confusing shouldering with phishing.

  Put it right: Shouldering is direct observation in person, while phishing uses deceptive messages.

• Thinking shouldering requires technical skill or malware.

  Put it right: It needs only close observation.

• Limiting the example to cashpoints only.

  Put it right: Any entry of private data in view, such as a password on a phone, is at risk.

• Believing the victim must be careless.

  Put it right: Even careful users can be overlooked in a crowd, so shielding matters.

Exam tips

• Name the technique and state that it involves observing private information directly.
• Use the cashpoint PIN example given in the specification to anchor your answer.
• Contrast it briefly with phishing to show you understand it is a different social-engineering method.
• Add a practical defence, such as covering the keypad, to demonstrate applied understanding.