Protect your PIN from shoulder surfing and card theft
Shoulder surfing is low-tech and effective: somebody watches you enter a PIN or phone passcode, then steals the card or phone or uses the information in a later scam. The defence is mostly physical - block the view, create distance and stop the transaction if someone crowds you.
Cover the keypad with your free hand, keep your body between the screen and people behind you, and cancel if someone distracts or crowds you. If your card or phone is then stolen, contact the bank immediately and use the device/account security controls available to you.
The PIN becomes much more valuable when the criminal also gets the card
A four-digit PIN alone is not useful in the same way as a password to an online account. The danger increases when somebody watches the PIN and then steals or traps the physical card. Take Five specifically warns that shoulder surfing is used alongside distraction theft and ATM card trapping.
That is why a person who “accidentally” bumps you or starts a conversation just after you used the ATM deserves caution. Secure the card before checking anything else.
Start with a real-world test rather than the label on the screen. Picture an ATM withdrawal where someone stands close enough to see the keypad. For 'The PIN becomes much more valuable when the criminal also gets the card', write down the card location, ATM time and place, cash-withdrawal alerts and the last transactions you recognise before changing anything. Covering the keypad protects against both nearby observers and hidden cameras, and the risk becomes much higher if the card is then stolen. If you withdrew £80 at 14:10 and see another £200 cash withdrawal at 14:24, report the second transaction and the possible PIN exposure together
Covering the keypad protects against people and cameras
LINK advises covering the PIN with one hand while entering it with the other. The habit matters even when nobody is visibly standing behind you because concealed cameras can be positioned around tampered machines.
Use the same discipline at shop terminals. A queue is not a reason to enter the PIN where the next customer can see it.
Treat 'Covering the keypad protects against people and cameras' as a sequence of checks. Using an ATM withdrawal where someone stands close enough to see the keypad, separate what is confirmed from what is only assumed, then compare the expected result with the actual result. Keep the card location, ATM time and place, cash-withdrawal alerts and the last transactions you recognise. If you withdrew £80 at 14:10 and see another £200 cash withdrawal at 14:24, report the second transaction and the possible PIN exposure together If the evidence does not line up, pause before you create another payment, application or instruction because a second action can make the original problem harder to trace.
Phone passcodes deserve the same privacy
A thief who sees a phone unlock code immediately before stealing the handset may gain access to more than the device itself. Banking, email and saved-password protections can depend on the phone lock and app settings.
Use biometrics where appropriate, keep the phone close in crowded places and avoid entering a passcode while someone is visibly watching. If the handset is stolen, act quickly through your mobile provider and bank.
A useful decision rule for 'Phone passcodes deserve the same privacy' is to take one controlled action at a time. If the card is missing or an unknown cash withdrawal appears, treat the card and PIN as compromised. In the example of an ATM withdrawal where someone stands close enough to see the keypad, the next step should preserve the card location, ATM time and place, cash-withdrawal alerts and the last transactions you recognise and leave you able to reverse course if new information appears. Freeze or report the card through the bank channel you opened yourself.
If you think somebody saw the PIN, decide whether the card is still under your control
If the card remains with you and there is no suspicious activity, changing the PIN can be a sensible precaution where your bank supports it. If the card is missing, trapped or stolen, do not waste time trying to change the PIN first - report the card immediately.
An ATM retained card should be treated as a card-security issue. LINK says to contact your bank or building society as soon as possible.
Build the fallback before the deadline becomes urgent. For 'If you think somebody saw the PIN, decide whether the card is still under your control', decide what you will do if the normal route fails: which official channel you will contact, which reference you will quote and what money or account access must remain available. If you withdrew £80 at 14:10 and see another £200 cash withdrawal at 14:24, report the second transaction and the possible PIN exposure together Keep the card location, ATM time and place, cash-withdrawal alerts and the last transactions you recognise together in one dated note so support can see the sequence without asking you to reconstruct it from memory.
Monitor the account after any suspicious incident
Check for cash withdrawals and card transactions you do not recognise. If one appears, tell the provider promptly. The FCA says unauthorised payments should be reported as soon as they are noticed and sets specific refund rules for them.
Keep the ATM or shop location and time. Those details can help distinguish the incident from unrelated card activity later that day.
Do not treat documentation as paperwork that comes after the problem. Under 'Monitor the account after any suspicious incident', the card location, ATM time and place, cash-withdrawal alerts and the last transactions you recognise are part of the solution because they show the bank what happened and when. If the card is missing or an unknown cash withdrawal appears, treat the card and PIN as compromised. Freeze or report the card through the bank channel you opened yourself rather than improvising with an unverified workaround.
PIN theft becomes much more dangerous when the card is stolen too
Cover the keypad with your free hand at cash machines and payment terminals, and create distance from anyone standing unusually close. A criminal who sees the PIN may then distract you, steal the card or use a tampered machine to retain it. If the card disappears shortly after somebody could have seen the PIN, report it immediately rather than waiting to see whether money moves.
Do not use an obvious PIN such as a birth year or repeated digits, and never write it on the card or keep it in the same wallet. If you think somebody observed the PIN but you still have the card, change the PIN through a trusted bank route where available and review recent ATM activity. The important question is whether the observer also gained access to the physical card or card details.
At an ATM, inspect the slot and keypad for anything obviously loose or unusual but do not dismantle the machine. If cash does not appear or the card is retained, step away from anyone offering help and contact the bank or machine operator using verified details. A stranger asking you to re-enter the PIN is not part of a normal recovery process.
Finish 'PIN theft becomes much more dangerous when the card is stolen too' with a stop condition. Decide in advance what fact would make you wait, what fact would make you contact the bank and what fact would make you abandon the transaction or application entirely. In an ATM withdrawal where someone stands close enough to see the keypad, the safest next step is the one that keeps essential money and evidence recoverable. Covering the keypad protects against both nearby observers and hidden cameras, and the risk becomes much higher if the card is then stolen. Freeze or report the card through the bank channel you opened yourself if the provider cannot explain the next step clearly.
Sources and verification
Victoria Hughes - Consumer Rights Specialist
PIN security is not about memorising more rules; it is about denying a watcher a clear view and keeping control of the card or phone immediately afterwards. The simple hand-over-keypad habit prevents both human observation and many camera-based attacks.
MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.