Is Your PIN Safe Against Advanced Human-Centric Shoulder Surfing?

Personal Identification Numbers (PINs) are a widely used authentication method, especially in systems with limited user input interfaces. Although numerous studies have investigated the vulnerabilities of PINs against various cyber threats, some attacks, such as basic shoulder surfing, are often mitigated by enhancing the complexity of the user-interface. This paper challenges that conventional approach by introducing an attack strategy that builds upon three basic classifiers−Decision Tree, Random Forest, and Naive Bayes. Through the examination of both four-digit and six-digit PINs, the findings reveal that even with only partial knowledge of a captured PIN sequence−due to the cognitive limitations of human adversaries−it is possible to predict the remaining digits of the PIN with a significant success rate. In some cases, this rate exceeds 50%, which is considerably higher than the 10% success rate expected from random guessing. Despite the diminished effectiveness of the proposed attack model for six-digit PINs, the results of this preliminary research are compelling enough to question the assumed ineffectiveness of Human-Centric Shoulder Surfing (HCSS).