--- id: CP-023 slug: tailgating-piggybacking-physical-intrusion lang: en title: "Tailgating and piggybacking: physical intrusion" description: An unknown, polite person enters behind you or with your consent. What employees see, how physical access fails, and the reflexes to adopt. canonical_url: https://startbrain.io/cyberpedia/en/articles/tailgating-piggybacking-physical-intrusion/ markdown_url: https://startbrain.io/cyberpedia/en/articles/tailgating-piggybacking-physical-intrusion.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: "Brain, \"Tailgating and piggybacking: physical intrusion\", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/tailgating-piggybacking-physical-intrusion/ (CC BY 4.0)" wing: 1 theme: outsmart_social_engineering reflex: cr-042 schema: G5 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/tailgating-piggybacking-physical-intrusion/ fr: https://startbrain.io/cyberpedia/fr/articles/tailgating-piggybacking-intrusion-locaux/ de: https://startbrain.io/cyberpedia/de/articles/tailgating-piggybacking-unbefugter-zutritt/ es: https://startbrain.io/cyberpedia/es/articles/tailgating-piggybacking-intrusion-fisica/ sources: - "n": 1 title: Avoiding Social Engineering and Phishing Attacks | CISA publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" - "n": 2 title: Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1200/ accessed: "2026-11-03" - "n": 3 title: Replication Through Removable Media, Technique T1091 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1091/ accessed: "2026-11-03" - "n": 4 title: Scattered Spider | CISA publisher: CISA url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a published: "2023-11-16" accessed: "2026-11-03" - "n": 5 title: "Phishing attacks: defending your organisation" publisher: NCSC (UK) url: https://www.ncsc.gov.uk/guidance/phishing published: "2018-02-05" accessed: "2026-11-03" --- # Tailgating and piggybacking: physical intrusion Tailgating and piggybacking are two ways of getting into premises without the right to be there. In tailgating, the person follows an employee without the employee's knowledge, slipping through before the door closes. In piggybacking, the person enters with the employee's consent, because the employee holds the door or lends a badge since the request looks normal. Both scenarios are social engineering: the intruder forces no lock and counts on politeness. The sources cited here do not describe tailgating itself. They describe deception by speech, borrowed identity and devices plugged in on site, that is, what an intruder can do once inside. This article sticks to what they say. ## In 30 seconds - Where it happens: at an entrance door, an airlock, a floor or a room where you are asked to hold the door or let someone through. - What the attacker wants: to be inside in order to place a device, plug in a storage medium or obtain information that the network would not give them. - The reflex: politely refuse, direct the person to reception, then report the situation. - If it has already happened: tell the people responsible for security in your organisation, even if your doubt is slight. ## Straight answers ### What is the difference between tailgating and piggybacking? In tailgating, the person slips in behind you without your having authorised it. In piggybacking, you let the person in, for example by holding the door. The result is the same: someone has entered without a badge of their own. ### Why is a polite stranger hard to refuse? Because the attacker relies on credibility. CISA describes an attacker who may seem « unassuming and respectable », who claims to be a new employee, a repair person or a researcher, and who sometimes offers credentials to back up that identity [1]. ### What can an intruder do once inside? MITRE technique T1200 describes the physical introduction of accessories, networking hardware or other devices into a system or network to gain access [2]. It states that public references to use by attackers are scarce, but that many authorised intrusion teams (red teams) use it for initial access [2]. ### Do employees have a real role in access control? Yes. An airlock, a badge or a reception desk only work if everyone uses them. The sources cited here do not quantify the share of intrusions that go through a held-open door. They do show, however, that the attacker looks for the contact who will answer, then for a second one if the first is not enough [1]. ## Inside the attacker's head The intruder chooses a pretext that explains their presence. CISA cites the new employee, the person in charge of a repair and the researcher [1]. The intruder can also proceed in stages: if one person does not give enough information, they contact another in the same organisation and rely on what the first said to appear more credible [1]. A reception desk, a security guard or a colleague passing by can thus serve, unknowingly, as a guarantee for the next person. The objective varies. It can be to plant hardware: MITRE cites tools such as the Bash Bunny or the Raspberry Pi, and cheap laptops, connected to the organisation's local network by the DarkVishnya group [2]. It can be to drop a removable medium, a case detailed below [3]. ## What you see on screen In this type of scenario, there is no suspicious screen: the scene itself is what matters. The following illustration is invented and does not reproduce any real case. ```text Illustration (fictional scene, no real case) [An unknown, friendly person, arms full, arrives behind you at a badge-controlled door and asks to be let through.] [They explain that they are expected or that they forgot their badge.] ``` What the employee notices first is ordinary politeness. The useful signals lie elsewhere: the person cannot prove who they are, has no internal contact to name, or insists. CISA recommends being wary of unsolicited visits, calls or emails from people who take an interest in employees or internal information, and verifying the identity of a person who claims to represent an organisation directly with that organisation [1]. In practice, you do not rely on the contact details the person supplies themselves. The first reflex is to politely refuse, then to direct the person to reception. The NCSC recommends checking important requests received by email through a second means of communication, including confirmation in person [5]. Applied to the door, this logic gives the following: a person who says they are expected can be announced by their internal contact. Then comes reporting. The NCSC describes a culture in which users report attempts, including those they fell for, which tells the organisation about attacks under way [5]. CISA asks that you notify the relevant people in the organisation, including network administrators, if you think you have disclosed sensitive information, so that they watch for any unusual activity [1]. ## Under the hood Access control rests on several layers: airlock, badge, reception. Each can be bypassed if an authorised person opens the way. The sources cited here do not detail these mechanisms. They do give the defences that matter once an intruder is inside the walls. MITRE recommends network access control rules, such as device certificates and the 802.1x standard, and restricting DHCP to registered devices to stop an unknown device from talking to trusted systems [2]. It also recommends blocking unknown devices and accessories through workstation configuration and a monitoring agent [2]. For removable media, MITRE explains that a mobile phone plugged in by USB, including through some charging cables, can infect a computer, especially if the Autorun feature is enabled [3]. It advises limiting the use of USB devices and removable media on a network [3]. ## Case files ### Scattered Spider, joint advisory of 16 November 2023, updated on 29 July 2025 This advisory was published by the FBI, CISA and several partner agencies, including the UK's NCSC [4]. It describes a criminal group that targets large companies and their outsourced IT help desks [4]. The case does not involve a physical intrusion: it is deception by phone and SMS. It nonetheless shows the same lever as tailgating, the impersonation of a trusted identity. The group posed as IT or support staff to obtain credentials or to get remote access tools launched [4]. The July 2025 update adds that members also posed as employees to obtain a password reset [4]. ### FIN7 and USB drives sent by mail MITRE reports that FIN7 actors mailed USB drives to potential victims. They contained malware that installs various backdoors, sometimes for ransomware operations [3]. Some drives behaved like a virtual keyboard [3]. The source gives no date for this case. It shows that a physical device can arrive without any intruder entering. ## Sources 1. CISA, "Avoiding Social Engineering and Phishing Attacks | CISA", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) 2. MITRE ATT&CK, "Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026) 3. MITRE ATT&CK, "Replication Through Removable Media, Technique T1091 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1091/ (accessed 3 November 2026) 4. CISA, "Scattered Spider | CISA", 16 November 2023. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a (accessed 3 November 2026) 5. NCSC (UK), "Phishing attacks: defending your organisation", 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/tailgating-piggybacking-physical-intrusion/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.