S.M.M.

Stop Manipulating Me · A Field Guide to Psychological Influence

ENTRY No. T14.5
CATEGORY Social Engineering
CLEARANCE Public / Essential
EDITION 01
Dossier · Manipulation Tactic

Tailgating

Physical Vector · Unauthorized Entry · Common
High Alert
How It WorksSEC 01

Tailgating gains entry to a physically restricted area by following an authorized person through a controlled door — exploiting politeness, authority cues, and the awkwardness of challenging a stranger, rather than presenting a valid credential. A badge reader or lock is a technical control, but the moment a real employee opens it, that control depends on a human deciding whether to admit the person behind them.

Several stagings recur: the hands-full ploy, where boxes or coffee trays make asking someone to badge in feel rude; a uniform or lanyard that borrows authority; joining a group at a propped smoke-break side door; or simply walking in with confident purpose so no one dares stop them. A near-sibling, piggybacking, is entry with the door-holder’s active but unwitting help.

Its defining feature: the barrier is technical, but the failure is social — a person choosing courtesy or conflict-avoidance over verification. Legitimate access invites verification; an intruder’s entry depends on the challenge not happening.

Warning SignsSEC 02
  • Someone entering close behind you without badging or authenticating themselves.
  • "Hands full" or door-held entries where no credential is ever presented.
  • Unfamiliar faces without a valid badge in badge-required areas.
  • Uniforms or props but no verifiable work order , escort, or reception check-in.
  • Someone lingering near a controlled door , waiting for an entrant.
  • Propped or informally used side doors that bypass the reception check.
Frequently Paired WithSEC 03
  • Authority Impersonation · T14.7
    Uniforms and roles supply the authority cue
  • Baiting · T14.4
    Sibling physical vector
  • Vishing · T14.8
    A pre-call pre-authorizes a "contractor" arrival
  • Phishing · T14.2
    A spoofed delivery notice stages the visit
How the Attack UnfoldsSEC 04
  • Stage 01 · Approach
    The intruder times arrival to an authorized person entering, carrying props or projecting belonging.
  • Stage 02 · Handoff
    Politeness, a uniform, or full hands prompt the employee to hold the door — the technical control passes to human courtesy.
  • Stage 03 · Foothold
    Now behind the perimeter, the intruder reaches workstations, equipment, or a network jack no badge reader guards.
Counter-ProtocolSEC 05
Defense: Everyone authenticates individually — courtesy is not a credential.
  • One badge per entry. Authenticate individually, every time — "no badge, no entry, even for me."
  • Challenge or redirect unbadged followers. "Everyone has to badge in; reception is right there." The organization must authorize and expect this.
  • Escort visitors to reception rather than admitting them; don't hold secure doors for strangers regardless of full hands.
  • Report propped doors and unfamiliar unbadged people.
  • Back the culture with hardware. Mantraps, turnstiles, and optical anti-tailgate sensors, plus visitor management.