Both shoulder surfing and phishing are types of social engineering attacks. However, shoulder surfing relies on malicious actors being in close physical proximity to the victim. Meanwhile, phishing is a digital attack where the malicious actor convinces the victim to share sensitive information by sending an email, text message, or instant message on a social media platform. Although both attacks can lead to identity theft and financial loss, phishing attacks are more prevalent and affect more people at once.