Shoulder surfing occurs when someone attempts to gain unauthorized access to sensitive information by observing the actions of someone else in a public place. In this scenario, the tourist is accessing an online banking site on a mobile device in a public place, and an attacker could potentially watch over their shoulder to see their login credentials or sensitive account information. This type of attack relies on physical observation, often in crowded or public areas.