Cyberpediaby Brain
ENDEFR

Badges, visitors and fire doors

An unknown person in technician's clothes, a door held open out of politeness: how social engineering gets into premises, and what to do.

In 30 seconds

Where it happens
At the entrance to the premises, at controlled-access doors, at reception, and in offices when a "contractor" walks around alone.
What the attacker wants
To get in, observe, plant a device3 or collect information4 by taking advantage of employees' politeness.
The reflex
Do not let in anyone you do not know, check with the person who is expected, and take the stranger to reception.
If it has already happened
Tell security or the security team right away, even if you are not sure of anything.

What it is

An intrusion does not always go through a screen. It can start at the building entrance, with a person who looks as if they belong: technician's clothes, a parcel in their arms, a badge that looks right. What opens the door is not a technical flaw, it is an employee's trust.

This page explains how this trick works and what everyone can do, at their own desk, to welcome a visitor without letting a stranger in. The sources cited here deal mostly with social engineering in general and with access through hardware plugged in on site3. The welcoming steps described below are common-sense rules to check against your company's own instructions.

Straight answers

Why call a physical intrusion social engineering?

Because the method is the same as for a booby-trapped email: deceiving a person. CISA describes the attacker who uses human interaction to obtain information about an organization or its systems1. He may seem "unassuming and respectable" and claim to be a new employee, a repairer or a researcher, sometimes showing identification as support1.

Who can show up at the door?

Contractors, for example. MITRE notes that organizations often give external providers extensive access, including infrastructure subcontractors such as heating and air conditioning, elevators or physical security2. A visitor in work clothes is therefore a common situation, which makes the trick believable.

What is someone after when they enter without being invited?

According to MITRE, an adversary can physically introduce accessories, network hardware or other devices into a system or network to use them as an access route3. MITRE also describes phishing for information as an attempt to make people reveal data, often credentials4. It lists among its methods the use of several messages that look urgent4.

What should you do about an unknown person with no escort?

CISA recommends being wary of unsolicited calls, visits or emails from people who ask about employees or internal information1. If the stranger claims to represent a legitimate organization, it advises verifying their identity directly with that organization1. In practice, you politely refuse to let them through, take them to reception and alert security.

Is a forgotten or lost badge really a problem?

The sources cited here do not cover lost badges. The principle remains simple: a badge opens doors for whoever carries it, whoever that is. Report the loss immediately, so that the access can be cut off.

1How it works1 min

A social engineering intrusion relies on credibility. CISA explains that if the attacker does not gather enough information from one person, they can contact another person in the same organization and rely on what the first one said to appear more trustworthy1. An employee who confirms "yes, he is expected" without having checked thus vouches for the stranger for what follows.

CISA states that every member of the community, colleagues included, is "the first line of defense" for security5. NIST lists physical and environmental protection among the control families of its SP 800-53 catalog, alongside awareness and training6. In other words, doors, badges and staff training belong to the same security system as passwords.

2What you do1 min

The actions below are prudent practices. Only the identity check with the organization concerned is backed by the sources cited here1.

  • Welcome the visitor at reception, not in a corridor, and escort them from the start of the visit to the exit.
  • Check their identity and badge with the person who is expecting them, using a number you already have, not the one the visitor gives you.
  • Do not hold a door for a person you do not know, even one carrying boxes. Offer to walk them to reception.
  • Never lend your badge and never let a colleague or a contractor use it in your place.
  • Report a lost or forgotten badge immediately, without waiting for the next day.
  • Never block a fire door in the open position and never unlock it for your own comfort. If it is a nuisance, tell security.
  • If an unknown person walks around alone, politely ask whom they are here to see, then take them to reception or alert security.
3Pitfalls1 min

Three levers come back in accounts of social engineering. The sources cited here document the first two for channels other than the front door, but they also apply at reception.

  • Feigned urgency. MITRE notes the sending of several messages that look urgent to push the target to reply4. At the entrance, this becomes "I'm late, the team is waiting for me."
  • False legitimacy. CISA notes that the attacker may claim to be a repairer and show identification as support1. Work clothes and a badge prove nothing until the expected person has confirmed.
  • Politeness. It is not mentioned in the sources cited here. Yet it pushes people to let someone in so as not to offend them. Refusing courteously is not a fault.

Another pitfall lies in what you do not see: a small device placed under a desk or plugged into a network socket. MITRE lists among the capabilities of this hardware passive network sniffing, traffic modification, keystroke injection and the addition of wireless access points3. An unknown device or a cable that should not be there is reported, it is not unplugged by yourself.

4Real cases1 min

DarkVishnya, banks attacked through direct connection

MITRE cites the DarkVishnya group, which physically plugged devices (a Bash Bunny, a Raspberry Pi, cheap netbooks and laptops) into the targeted organization's environment to access its local network3. MITRE points to an analysis dated 6 December 2018, titled "DarkVishnya: Banks attacked through direct connection to local network"3. The sources cited here do not say how the devices were brought into the premises.

MITRE also states that publicly documented uses by malicious actors are rare, whereas many penetration testing teams use these hardware additions as an initial access3.

Fact sheet

Identifier
CP-365
Wing
5. Office life and reflexes
Brain skill
Foiling Scams (handle_scams)
Brain reflex
cr-084
Diagram
G5 · Employee Decision Tree
Languages
de, en, fr
Sources
6 sources checked on 3 November 2026
Sources6 sources
  1. CISA, “Avoiding Social Engineering and Phishing Attacks”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
  2. MITRE ATT&CK, “Trusted Relationship, Technique T1199 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1199/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026)
  4. MITRE ATT&CK, “Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026)
  5. CISA, “Physical Security | Cybersecurity and Infrastructure Security Agency CISA”. https://www.cisa.gov/topics/physical-security (accessed 3 November 2026)
  6. NIST, “SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations | CSRC”. https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final (accessed 3 November 2026)

Cite this article

Brain, “Badges, visitors and fire doors”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/physical-security-badges-visitors/

BibTeX 
@misc{brain_cp365_en_2026,
  author = {Brain},
  title = {Badges, visitors and fire doors},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/physical-security-badges-visitors/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence