Social Engineering & FraudMANIPULATIVE

Tailgating / Piggybacking

What it is

Gaining entry to a restricted physical space by following an authorized person through a controlled door, relying on ordinary courtesy and the reluctance to challenge a stranger who looks like they belong.

How it works

Physical access controls assume a person will not hold the door for someone who has not badged in, but social norms push the other way: holding a door is polite, and demanding a stranger prove their right to be there feels rude and confrontational. The intruder engineers the moment so that refusing help would be the awkward choice, by carrying a full coffee tray, wheeling boxes, wearing a plausible uniform or lanyard, or simply falling into step behind a group at a busy entrance. Strictly, tailgating is following without the authorized person's awareness, while piggybacking is following with their consent (they hold the door), but the exploited lever is the same social reluctance to challenge. Once inside, the intruder inherits the trust the building grants to anyone past the lobby, which is why sensitive areas that rely on a single badge check at the perimeter are so exposed. Hadnagy and Johnny Long document how a clipboard, a hard hat, or an air of belonging routinely substitutes for credentials.

Real-world examples

  • •An intruder in a delivery uniform, arms full of packages, waits by a badge-controlled door until an employee holds it open; the visible burden makes the courtesy automatic.
  • •Smokers returning from a break form a group at a side door, and one extra person joining the cluster is waved through without anyone recalling whether they badged.
  • •Penetration testers routinely report walking into data centers and executive floors wearing a high-visibility vest and carrying a ladder, because tools and a uniform read as authorization.
  • •A visitor who is genuinely inside for a meeting props a fire door for a colleague, unknowingly admitting someone who used the meeting as timing cover.

Ethical guidelines

  • ●Entering a space you are not authorized to enter by exploiting someone's courtesy is trespass, whatever costume is worn.
  • ●Authorized physical penetration tests need a signed authorization letter carried on the person, a named point of contact, and clear boundaries that exclude areas where safety could be compromised.
  • ●Security policy should make challenging a stranger the expected, blameless behavior, so employees are not forced to choose between courtesy and security.

How to defend against it

  • ►Practice the polite challenge: "Hi, can I help you find someone?" lets you verify a stranger without hostility, and gives cover to anyone who feels awkward doing it.
  • ►Badge in one person per swipe as a stated rule, and do not hold secure doors for people you do not personally recognize, however full their hands look.
  • ►Use mantraps, turnstiles, or anti-passback controls for sensitive areas so that courtesy alone cannot admit a second person.
  • ►Give visitors visibly distinct badges and require escorts; a uniform or lanyard should never be treated as proof on its own.
  • ►Report propped or malfunctioning secure doors immediately; a door wedged open converts every access control behind it into decoration.

From the Defense Playbook

Verify, Then Trust (for Authority Claims)minutes

Separate the symbols of authority (a title, a uniform, a badge, a confident tone, an official-looking letterhead) from the fact of authority, and check the fact through a source the claimant does not control before you comply.

Every playbook entry states how strong its evidence is and when not to use it. Browse the full playbook.

References

  1. Hadnagy, C. (2018). Social Engineering: The Science of Human Hacking (2nd ed.). Wiley
    Documented use of uniforms, props, and confident demeanor to substitute for credentials at physical access points.
  2. Long, J., Wiles, J., & Mitnick, K. (2008). No Tech Hacking: A Guide to Social Engineering, Dumpster Diving, and Shoulder Surfing. Syngress
    Field accounts of gaining physical entry through courtesy and appearance rather than technical means.
  3. Mitnick, K. D., & Simon, W. L. (2005). The Art of Intrusion: The Real Stories Behind the Exploits of Hackers, Intruders and Deceivers. Wiley
    Case narratives of physical intrusions relying on the reluctance of employees to challenge apparent insiders.
Last reviewed
Suggest a correction

Detect Tailgating / Piggybacking in any text

Paste any message, email, or article into our free Manipulation Detector to see if Tailgating / Piggybacking or other techniques are being used on you.

Try the Detector FreeCreate Free Account

Related Articles

Social Engineering: Why Smart People Fall for It

Social engineering does not target stupidity. It targets helpfulness, deference, and time pressure, which are the same habits that make people good at their jobs. Here is how the attacks are built and which procedures actually stop them.

7 min read

The Disinformation Playbook: How Campaigns Are Built and Where They Break

Disinformation campaigns follow a recognizable sequence: seed, launder, amplify, and let real people carry it the rest of the way. A field guide to the stages, drawn from the research, with the defences that work at each one.

8 min read