Don't Let Strangers Tailgate
Someone with a coffee in each hand asks you to hold the secure door — and just like that, your office's badge system means nothing. Tailgating (following an authorized person through) is how most physical breaches happen: no hacking, just politeness exploited. Stopping it is awkward for about three seconds.
TL;DR / Quick Fix
Quick fix: never hold a secure door for someone you don't recognize — a polite 'please badge in' stops tailgating cold. Report strangers without badges to security or reception. It feels rude the first time; it is the single most effective physical security habit.
Follow these steps
- Learn what tailgating looks like. It's not dramatic: someone follows you through a badge door, asks you to hold it, or slips in behind a group. Attackers count on politeness — it's a social engineering move in physical form.
- Use the polite refusal line. 'Please badge in behind me' — friendly, firm, final. Practice it once and it stops feeling rude; most legitimate employees expect it.
- Don't hold doors for strangers. Holding the door is kind at a café and a security failure at a badge reader. Let the door close and let them badge — that's what the system is for.
- Challenge politely, escalate calmly. 'Hi — can I help you find someone?' works for loiterers. If they can't answer or get hostile, walk away and call security; never physically confront.
- Report it every time. Tell security or reception about tailgating attempts, even failed ones. Patterns matter — one report is an anecdote, five are an investigation.
- Protect the loading dock too. Service entrances and smoking areas are the classic bypass routes. The same rules apply everywhere, not just the pretty front lobby.
What NOT to do
- Do not assume a confident stranger belongs. Attackers dress the part and act entitled — confidence is the costume, not a credential.
- Do not lend your badge, ever. A borrowed badge plus your name creates accountability nightmares when something goes missing.
- Do not prop secure doors open. Convenience propping — for deliveries, fresh air, anything — voids the entire access system.
- Do not confront aggressively. Your job is to not admit them and to report; physical confrontation is security's job, not yours.
Frequently asked questions
Isn't refusing rude?
It feels that way exactly once. Workplaces with real security cultures expect it — colleagues will respect the habit, and attackers count on you not having it.
What if they claim they forgot their badge?
Direct them to reception or security for a temporary badge. That's the process — helping them bypass it helps attackers too.
Does this really happen?
Constantly — it's among the most common physical intrusion methods precisely because it exploits manners, not systems.
What to read next
- Phishing Red Flags
- Stop Shoulder Surfing