They can also still steal a PIN by " shoulder surfing " ( looking over a card holder 's shoulder ) , or by using hidden cameras or even special key pads that are put on top of a genuine terminal to record the numbers keyed in .