Shoulder surfing at work: screens, shared desks and locking up

MacWindowsUpdated

Shoulder surfing is someone reading your screen or watching you type, often your password. At work, the fixes are small: be aware of who can see your screen, keep previews off the lock screen, never share or leave out your password, and lock your Mac or PC every time you step away from the desk.

Quick answer

Sit so your screen faces away from walkways where you can, and consider a privacy filter, which the NCSC suggests. Set Mac notification previews to show only when unlocked. Lock the screen every time you leave: Control-Command-Q on a Mac, Windows logo key + L on Windows. If someone saw your password, change it.

What is shoulder surfing?

It's looking at someone else's screen, or watching them type, without them meaning you to. The NCSC lists shoulder surfing, "observing someone typing in their password", as one of the ways passwords get discovered.

It's worth separating two things. Looking at a screen isn't the same as getting into a device. The Crown Prosecution Service's guidance says the unauthorised access offence in the Computer Misuse Act doesn't cover reading data displayed on a screen. Using a device you aren't allowed to use is a different matter, covered in what to do if someone at work accessed your laptop.

HP surveyed 1,500 office workers across Canada, the UK and the United States, alongside 3,000 members of the general public. Its press kit for the survey, dated 25 September 2019, reported that "4 in 5 creep on their coworkers' screens". That's people saying they look at screens, not that they used anyone's computer. For figures on device access itself, see colleague snooping statistics.

How do I stop people reading my screen?

Start with where you sit and what your screen shows when you're not looking at it. The NCSC's advice for staff is to be aware of who might be able to see your screen when you're using your device, and to consider a screen privacy protector if it applies. It notes that on touch screens it's particularly easy for bystanders to see what you type, even passwords.

  1. Angle your screen away from walkways and shared spaces where your desk allows it.
  2. Ask IT about a privacy filter for your laptop or monitor.
  3. On a Mac, choose Apple menu > System Settings, click Notifications, and set Show previews to When Unlocked. Apple says this shows previews only when you're logged in to your user account, so message text doesn't appear on the locked screen.
  4. Close or minimise anything sensitive before someone comes over to look at something else on your screen.

How do I keep my password private in an office?

Don't let anyone see it, hear it or find it. The NCSC tells staff never to disclose their password to anyone, including IT support staff, a manager or a colleague, in person, by phone, by email or by text.

  1. Type your password with the keyboard turned away from others. For unlocking a device, the NCSC says fingerprint or face recognition is better still than a PIN or password alone, so use Touch ID on a Mac where you can.
  2. If you write a password down, the NCSC says store it securely and never with the device. Its early years guidance gives the example of a password on a sticky note on the computer.
  3. Don't reuse a work password anywhere else. The NCSC says never share the same password across different systems or devices.

If you think someone saw you type it, change it. On a Mac, choose Apple menu > System Settings, click Users & Groups, click the Info button next to your name, then click Change. On a work account, ask IT how to change it. Our guide to what to do if someone watched you type your passcode covers phones.

How should I lock up at a shared desk?

Lock every time you stand up, even for a minute: Control-Command-Q on a Mac, Windows logo key + L on Windows. The NCSC's guidance for early years staff says to use a lock screen when you're not at your desk. Its advice for end users says not to leave a device unattended in an insecure location, and to lock it away if possible, or keep it on you.

Automatic locking, hot corners and Dynamic lock are covered in how to lock your Mac screen, and leaving a laptop overnight in leaving your laptop at work or in a library.

What about plugging things in at a hot desk?

Be careful with shared cables and drives. The NCSC tells staff to use only devices their organisation has approved, to recharge only with trusted power adapters and cables, and not to physically connect their device to any computer, by USB, HDMI or similar, without IT's approval. If a hot desk has a dock or cable you don't recognise, check with IT before using it.

What if it keeps happening?

Raise it. Someone regularly reading your screen is a conversation for your manager or HR, and anything that suggests they've used your device is one for IT as well. Write down what happened and when. Our guide on how to report snooping at work explains the routes, from a grievance to the ICO.

Where Failshot fits

Your password is the first layer. Failshot is the second: a photo of whoever unlocks your Mac while you're away from your desk.

While it's on, Failshot photographs whoever unlocks your Mac, then, with Pro, records a 5-second video, and its window tells them the unlock was photographed. With Pro, turn on alerts and Failshot emails you about an unlock you don't confirm as yours, with the photo and the time. Switching it off, or quitting it from its menu, takes Touch ID or your Failshot PIN and answer, never your Mac password.

It's for a Mac you own or are authorised to manage, running macOS 14 or later. Free to download. It's free to use. Pro adds video, email alerts and the encrypted vault, and you can try Pro free for 7 days. The trial is on failshot.app, for the Mac. iPhone, Android and Windows are coming soon.

More questions

Is shoulder surfing illegal?

Reading someone's screen isn't the Computer Misuse Act's unauthorised access offence: the CPS says reading data displayed on a screen isn't covered. Using a password you saw to get into someone's account or device is different. See is it illegal to access someone's computer in the UK.

Does a privacy screen filter help?

The NCSC suggests considering a screen privacy protector where it applies, alongside being aware of who can see your screen. A filter doesn't help if you leave the screen unlocked, so locking up still matters.

What if my screen showed other people's personal data?

Tell IT, or whoever handles data protection where you work, and say what was on screen and who could have seen it. Whether it counts as a data breach depends on the details, which our guide on whether a colleague reading your files is a data breach explains.

Can I use Failshot on my work Mac?

Only with your employer's agreement. It's their device, and they're responsible under data protection law for any monitoring on it. For Failshot, that also means they've agreed Failshot's Organisation Terms and told everyone who uses the laptop before Failshot is turned on.

Should I hide notifications at work?

On a Mac, setting Show previews to When Unlocked keeps message text off the locked screen. Apple says the Never option hides previews altogether. Choose what suits how often people walk past your desk.

Sources