Stop Tailgating Attacks
Someone with full hands and a friendly smile slips in right behind you through the badge-locked door — and you hold it, because refusing feels rude. That is tailgating: the oldest physical hack in the book, and the reason digital security means nothing if a stranger can just walk in. Politeness is the vulnerability; a few social scripts fix it.
TL;DR / Quick Fix
Quick fix: tailgating is walking into a secured building behind an authorized person — it works because holding the door feels polite. Let the door close and make everyone badge individually; it is policy, not rudeness. If someone forgot their badge, direct them to reception.
Follow these steps
- Understand the attack. The stranger is not lost — they are counting on your politeness to bypass every digital lock in the building. Once inside, they can plug into the network, steal devices, or plant hardware. The office pattern shows how common this is.
- Let the door close. The core habit: do not hold secured doors. A brief 'sorry, policy' with a smile is the complete social script — awkward for three seconds, then forgotten.
- Direct strangers to reception. Forgot your badge? Reception reissues it in a minute. Walking someone past security yourself makes you responsible for whatever they do inside.
- Challenge politely. An unfamiliar face in a restricted area gets a friendly 'Hi! Can I help you find someone?' — helpful if lost, revealing if not. You are not security; you are a sensor.
- Report, do not confront. Someone aggressive about entry is a security-team problem, not yours. Note the description and call it in — heroes get hurt, reporters get thanked.
- Protect the digital side too. A tailgater at an unlocked workstation is game over. Lock your screen every time you stand up — physical access plus an open laptop is the jackpot.
What NOT to do
- Do not hold secured doors for strangers. Every exception you make is the attack working exactly as designed.
- Do not assume a confident stranger belongs. Confidence is the costume — badges are the proof.
- Do not confront aggressively. Your job is to not grant access and to report; physical confrontation is for security staff.
- Do not leave your workstation unlocked. Tailgating plus an open laptop is the whole prize — Win+L every time you stand.
Frequently asked questions
Is it rude to not hold the door?
No — it is policy, and every security-aware workplace expects it. A smile and 'gotta let it close, sorry!' keeps it friendly.
What if they say they forgot their badge?
Point them to reception with a smile. Real employees know the drill; attackers count on you skipping it.
Does this really happen?
Constantly — it is among the most common physical breaches precisely because it exploits politeness, not technology.
What to read next
- Stop MFA Fatigue Attacks
- What Are Phishing Kits?