Cyberpediaby Brain
ENDEFR

Tailgating and piggybacking: physical intrusion

An unknown, polite person enters behind you or with your consent. What employees see, how physical access fails, and the reflexes to adopt.

In 30 seconds

Where it happens
At an entrance door, an airlock, a floor or a room where you are asked to hold the door or let someone through.
What the attacker wants
To be inside in order to place a device, plug in a storage medium or obtain information that the network would not give them.
The reflex
Politely refuse, direct the person to reception, then report the situation.
If it has already happened
Tell the people responsible for security in your organisation, even if your doubt is slight.

What it is

Tailgating and piggybacking are two ways of getting into premises without the right to be there. In tailgating, the person follows an employee without the employee's knowledge, slipping through before the door closes. In piggybacking, the person enters with the employee's consent, because the employee holds the door or lends a badge since the request looks normal.

Both scenarios are social engineering: the intruder forces no lock and counts on politeness. The sources cited here do not describe tailgating itself. They describe deception by speech, borrowed identity and devices plugged in on site, that is, what an intruder can do once inside. This article sticks to what they say.

Straight answers

What is the difference between tailgating and piggybacking?

In tailgating, the person slips in behind you without your having authorised it. In piggybacking, you let the person in, for example by holding the door. The result is the same: someone has entered without a badge of their own.

Why is a polite stranger hard to refuse?

Because the attacker relies on credibility. CISA describes an attacker who may seem « unassuming and respectable », who claims to be a new employee, a repair person or a researcher, and who sometimes offers credentials to back up that identity1.

What can an intruder do once inside?

MITRE technique T1200 describes the physical introduction of accessories, networking hardware or other devices into a system or network to gain access2. It states that public references to use by attackers are scarce, but that many authorised intrusion teams (red teams) use it for initial access2.

Do employees have a real role in access control?

Yes. An airlock, a badge or a reception desk only work if everyone uses them. The sources cited here do not quantify the share of intrusions that go through a held-open door. They do show, however, that the attacker looks for the contact who will answer, then for a second one if the first is not enough1.

1Inside the attacker's head1 min

The intruder chooses a pretext that explains their presence. CISA cites the new employee, the person in charge of a repair and the researcher1. The intruder can also proceed in stages: if one person does not give enough information, they contact another in the same organisation and rely on what the first said to appear more credible1. A reception desk, a security guard or a colleague passing by can thus serve, unknowingly, as a guarantee for the next person.

The objective varies. It can be to plant hardware: MITRE cites tools such as the Bash Bunny or the Raspberry Pi, and cheap laptops, connected to the organisation's local network by the DarkVishnya group2. It can be to drop a removable medium, a case detailed below3.

2What you see on screen1 min

In this type of scenario, there is no suspicious screen: the scene itself is what matters. The following illustration is invented and does not reproduce any real case.

Excerpt
Illustration (fictional scene, no real case)
[An unknown, friendly person, arms full, arrives behind you
 at a badge-controlled door and asks to be let through.]
[They explain that they are expected or that they forgot their badge.]

What the employee notices first is ordinary politeness. The useful signals lie elsewhere: the person cannot prove who they are, has no internal contact to name, or insists. CISA recommends being wary of unsolicited visits, calls or emails from people who take an interest in employees or internal information, and verifying the identity of a person who claims to represent an organisation directly with that organisation1. In practice, you do not rely on the contact details the person supplies themselves.

The first reflex is to politely refuse, then to direct the person to reception. The NCSC recommends checking important requests received by email through a second means of communication, including confirmation in person5. Applied to the door, this logic gives the following: a person who says they are expected can be announced by their internal contact.

Then comes reporting. The NCSC describes a culture in which users report attempts, including those they fell for, which tells the organisation about attacks under way5. CISA asks that you notify the relevant people in the organisation, including network administrators, if you think you have disclosed sensitive information, so that they watch for any unusual activity1.

3Under the hoodIT teams1 min

Access control rests on several layers: airlock, badge, reception. Each can be bypassed if an authorised person opens the way. The sources cited here do not detail these mechanisms. They do give the defences that matter once an intruder is inside the walls.

MITRE recommends network access control rules, such as device certificates and the 802.1x standard, and restricting DHCP to registered devices to stop an unknown device from talking to trusted systems2. It also recommends blocking unknown devices and accessories through workstation configuration and a monitoring agent2.

For removable media, MITRE explains that a mobile phone plugged in by USB, including through some charging cables, can infect a computer, especially if the Autorun feature is enabled3. It advises limiting the use of USB devices and removable media on a network3.

4Case filesReal cases1 min

Scattered Spider, joint advisory of 16 November 2023, updated on 29 July 2025

This advisory was published by the FBI, CISA and several partner agencies, including the UK's NCSC4. It describes a criminal group that targets large companies and their outsourced IT help desks4. The case does not involve a physical intrusion: it is deception by phone and SMS. It nonetheless shows the same lever as tailgating, the impersonation of a trusted identity. The group posed as IT or support staff to obtain credentials or to get remote access tools launched4. The July 2025 update adds that members also posed as employees to obtain a password reset4.

FIN7 and USB drives sent by mail

MITRE reports that FIN7 actors mailed USB drives to potential victims. They contained malware that installs various backdoors, sometimes for ransomware operations3. Some drives behaved like a virtual keyboard3. The source gives no date for this case. It shows that a physical device can arrive without any intruder entering.

Fact sheet

Identifier
CP-023
Wing
1. Attacks and techniques
Brain skill
Outsmarting Social Engineering (outsmart_social_engineering)
Brain reflex
cr-042
Diagram
G5 · Employee Decision Tree
Languages
de, en, fr
Sources
5 sources checked on 3 November 2026
Sources5 sources
  1. CISA, “Avoiding Social Engineering and Phishing Attacks | CISA”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
  2. MITRE ATT&CK, “Hardware Additions, Technique T1200 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1200/ (accessed 3 November 2026)
  3. MITRE ATT&CK, “Replication Through Removable Media, Technique T1091 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1091/ (accessed 3 November 2026)
  4. CISA, “Scattered Spider | CISA”, 16 November 2023. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a (accessed 3 November 2026)
  5. NCSC (UK), “Phishing attacks: defending your organisation”, 5 February 2018. https://www.ncsc.gov.uk/guidance/phishing (accessed 3 November 2026)

Cite this article

Brain, “Tailgating and piggybacking: physical intrusion”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/tailgating-piggybacking-physical-intrusion/

BibTeX 
@misc{brain_cp023_en_2026,
  author = {Brain},
  title = {Tailgating and piggybacking: physical intrusion},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/tailgating-piggybacking-physical-intrusion/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence