Shoulder Surfing & Visual Disclosure

Shoulder surfing involves deliberate observation of information displayed or entered on a screen, keyboard, phone, document, badge, or other visible surface. Visual disclosure covers broader exposure in which sensitive information becomes visible outside its intended audience, whether or not the observer is positioned directly behind the person handling it.

Normal work can create observation opportunities. Screens face shared spaces, documents remain visible, authentication steps occur in public, and workplace details appear in photographs or video. Attention is usually directed at the task rather than the surrounding viewing angles or audience.

Observed information can support later impersonation, credential theft, physical intrusion, or other social engineering activity. Direct system access is unnecessary where useful identities, access patterns, internal names, meeting details, or authentication material are already visible.

How it appears

Shoulder surfing and visual disclosure occur across workplaces, public spaces, shared offices, remote work settings, events, and transport. Exposure may be brief and opportunistic or sustained through deliberate positioning and observation.

Information can be visible on screens, printed material, whiteboards, badges, room displays, notification previews, or images captured in the surrounding environment. The value of the exposure depends on what can be inferred or reused after observation.

Element	What it means	Examples
Visible source	The surface or environment from which information can be observed.	Screen, phone, document, whiteboard, badge, dashboard, printer tray, meeting room display.
Exposed detail	The information available to the observer.	Password, MFA code, customer record, internal system, meeting detail, staff name, access pattern.
Observation opportunity	The situation or viewing position that makes the information visible.	Open-plan desk, public transport, café, reception area, conference, unlocked device, unattended room.
Observer	The person or audience able to view the information.	Visitor, customer, contractor, nearby passenger, attendee, unauthorised staff member, camera viewer.

Indicators

Indicators of shoulder surfing and visual disclosure arise where sensitive information is visible to an uncontrolled, unknown, or broader audience than the workflow requires.

Indicator	What to look for
Visible sensitive content	Customer records, internal systems, dashboards, financial information, HR material, incident details, or confidential documents are readable from nearby positions.
Observable authentication	Passwords, PINs, MFA prompts, recovery codes, access codes, lock patterns, or authentication steps can be seen during entry or approval.
Unattended documents	Printed material remains on desks, printers, meeting tables, reception counters, or shared workstations where the audience is uncontrolled.
Uncleared meeting spaces	Whiteboards, room displays, flip charts, shared notes, or presentation content remain visible after the relevant activity has ended.
Badge or pass exposure	Staff badges, visitor passes, access cards, lanyards, or identity details are clearly readable by unauthorised people or in captured images.
Public or shared workspace exposure	Sensitive work is conducted where nearby viewers can observe screens or documents without a legitimate need to see the information.
Notification leakage	Message previews, calendar details, authentication prompts, customer information, or internal alerts remain visible on unattended or exposed devices.
Photography or video exposure	Images capture screens, documents, whiteboards, badges, labels, floor layouts, restricted areas, or operational details in the background.
Deliberate observation behaviour	A person repeatedly watches screens, reads badges, photographs work areas, lingers near sensitive activity, or changes position to improve visibility.