Commuters witness personal payslip details, private texts, and social media feeds in the glow of someone else’s phone