Sensitive payment entry needs anti-shoulder-surf and anti-screenshot

What it is

For the seconds a PAN, CVV, password, or OTP sits on screen, bystanders and system screenshots can take it. Anti-shoulder-surf and anti-screenshot means default masking, rec-flagging, covering or omitting sensitive regions in captures, and a public-place screen-angle hint. It is not whether a lock icon is on the page, and not whether a large amount needs a step-up.

Why it happens

Payment typing happens in cafés, commutes, and screen-shared meetings; the visual channel is open to whoever is nearby. A three-digit CVV is a glance. Masking cuts bystander bandwidth; full mask blocks checking the last four, so fields are usually segmented. If the OS lets the app screenshot or remote-assist inject, a malicious or accidental “auto screenshot” parks an unmasked frame in photos or cloud. Apps can declare the payment page FLAG_SECURE-style; capability varies by platform. If the declaration fails, at least do not leave a full PAN in the capture. OTP notification previews are another shoulder-surf surface; the page should not make people hold the code in notifications.

Studying it

Complete entry with an observer seated beside. Compare full visible, segmented mask, screenshot blocked. On device, fire screenshot and screen record and inspect the album for sensitive fields.

Independent variables: mask policy, system block on capture, OTP via autofill vs notification preview. Dependent variables: digits the observer can restate, user check errors, plaintext in the capture.

Lab observers are allowed to stare and will overstate shoulder-surf success. Real shoulder-surf is periphery. “I feel safe” is not anti-screenshot evidence; look at the captured image.

Where it stops holding

Desktop browsers often cannot block OS screenshots; mask plus a public-place note is what you have—do not pretend mobile FLAG_SECURE exists. Assistive users may need full visibility or speech; masking must not kill accessible labels—speech itself is public, so offer a headset hint. Counter staff typing for a customer is defending the queue behind, a different mask policy.

Applying it

• Mask CVV and passwords by default; PAN may show last four for check.
• Request system-level block of screenshot/record on the pay page; if it fails, fields stay masked and capture previews are redacted.
• Prefer system OTP autofill so plaintext sits less in notifications.
• Verify by taking a system screenshot on the pay page: no full PAN or CVV. Then have someone seated aside watch one entry; digits recovered should be below the fully visible condition.

Related

• Within the group: H7.11.1 Payment pages need recognizable security cues · H7.11.3 Large or anomalous payments need step-up identity checks · H7.11.4 Too many security warnings desensitize people to real ones
• Adjacent: H6.05 Biometrics · H6.03 OTP and passwordless login · O3.17 On-screen exposure of sensitive information
• Search terms: shoulder surfing · screenshot protection · PAN masking