Social engineering: shouldering (or shoulder surfing).

The idea

Shouldering, also called shoulder surfing, is a social-engineering attack in which someone observes a person's screen or keyboard to capture information. The attacker stands or sits close enough to read a password being typed, a PIN entered at a cash machine, or confidential data on a display. No software or network access is needed — the weakness is the physical environment and the victim's lack of awareness. It often happens in public places such as trains, cafés or queues. Defences are physical and behavioural: shield the keypad or screen, angle the device away from onlookers, use a privacy filter, and stay alert to people standing unusually close.

What earns the marks

• Defines shouldering as observing a person's screen or keypad to obtain information.
• Notes the alternative name shoulder surfing.
• Identifies what is captured: passwords, PINs or confidential on-screen data.
• Explains that it exploits physical proximity and the victim's lack of awareness, not software.
• Gives a typical setting such as a public place, train or cash machine.
• Suggests a defence such as shielding the keypad, using a privacy filter or angling the screen.

Common mistakes and how to put them right

• Treating shouldering as a hacking technique.

  Put it right by explaining it relies on direct observation, not code.

• Assuming it only happens at cash machines.

  Put it right by noting laptops, phones and tablets in public are also targets.

• Thinking a strong password prevents it.

  Put it right by explaining the attacker simply watches the password being entered.

• Ignoring the physical setting.

  Put it right by linking the attack to proximity in public places.

Exam tips

• Name the attack precisely and give its alternative name to show understanding.
• Describe what the attacker observes, such as a typed password or a PIN.
• Offer a physical defence, for example shielding the keypad or using a screen filter.