TechKnowSurge

VideoSecurityFree

Tailgating and Piggybacking

Tailgating and piggybacking are physical social engineering attacks where an unauthorized person gains access to a secured area by following an authorized individual through a controlled entry point. The key distinction is consent: tailgating occurs without the authorized person's awareness, while piggybacking relies on their cooperation.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Tailgating and piggybacking are physical access attacks that exploit human behavior rather than technical vulnerabilities. Both involve an unauthorized individual gaining entry to a secured or restricted area by leveraging an authorized person's access, and the two techniques differ by a single variable: whether the authorized person is aware they are helping the attacker gain entry. Understanding that distinction is essential for recognizing and preventing both threats in real-world environments. Tailgating occurs when an attacker follows an authorized person through a controlled entry point without that person's knowledge or consent. The attacker typically positions themselves close enough to slip through before a door locks or closes, and the authorized individual never realizes access was granted to anyone else. A practical example is an attacker who waits for a badged employee to exit an elevator, then blocks the closing doors at the last moment to re-enter — gaining access to the secured floor while the employee has already moved on and noticed nothing. Piggybacking relies on the same physical dynamic but adds a layer of social engineering to obtain the authorized person's willing assistance. The attacker typically adopts a convincing cover identity — a contractor, delivery person, or maintenance technician — and directly requests that the authorized individual hold the door or grant access. Because the attacker appears to have a legitimate reason to be present, the authorized person complies without suspicion. Defending against both attacks requires a combination of physical controls, such as anti-tailgate barriers and access vestibules, and a security-aware culture in which employees understand that verifying identity is not a courtesy issue but a security responsibility.

What you'll learn

Distinguish between tailgating and piggybacking attacks, including the role of consent in each physical security breach scenario

What's covered

Tailgating & Piggybacking

Tailgating Defined
- Without Victim Consent
- Follows Closely Through Entry
- Victim Unaware of Follower
Piggybacking Defined
- With Victim Consent
- Adversary Requests Entry
- Victim Assumes Legitimacy
Real-World Examples
- Elevator Badge Door Theft
  - Hand Blocks Closing Door
  - Bike Stolen — Tailgating
- Fake Maintenance Worker
  - Hands Full — Appears Busy
  - Victim Holds Elevator — Piggybacking
Key Distinguishing Factor
- Consent vs. No Consent
- Attacker Acts Authorized

Key terms

Tailgating: A physical security breach where an unauthorized person follows an authorized individual through a secured entry point without presenting credentials.
Piggybacking: A physical security attack where an unauthorized person follows an authorized person through a secured entry point with the authorized person's consent, typically by deceiving them.
Social Engineering: A manipulation technique that exploits human psychology to trick individuals into revealing confidential information.
Access Control: A security mechanism that restricts access to resources based on policies, roles, or identity.

Topics

Physical Security Social Engineering Tailgating Piggybacking Access Control

Transcript

Many times, if we just act like we are supposed to be somewhere, somebody assumes that we are supposed to be there. And that is what is leveraged when it comes to tailgating and piggybacking.

Tailgating

Tailgating happens when an attacker follows a victim into a locked area or inaccessible area. Maybe it is a building, maybe it is a room, or whatever the case may be. This victim right here has access to it, so they will walk right through, and maybe they do not understand or do not realize that somebody is following them into that room. So the key to this is that it is without consent. Tailgating is an unauthorized person following an authorized person through an entry point without consent.

If you want to think of tailgating when you are driving, tailgating is when you follow too close. And so often that is what happens when somebody goes into a building or into a locked room or into a locked area, and then somebody follows really close behind them and accesses it before it has a chance to lock. So it is the same type of concept, that they are very close to that person and they get through before that access point locks.

Piggybacking

Piggybacking is essentially the same thing, but the idea with this is that it is with consent rather than without consent. So in this case right here, maybe this person, this adversary, has their hands full. And so as this victim is going through, he says, "Hold the door. Please wait for me." And this victim just assumes that they are supposed to be in there, and so they actually open the door up and allow this adversary to get into this locked area.

So tailgating is without consent, meaning that the person probably did not see them and that is why they were able to get through, versus piggybacking is with consent, meaning that they actually went out of their way to help this person through this entry point.

A Personal Example

Let me give you a personal example of one that I have experienced. I was working for a company that had an elevator. This elevator would go from the first floor to all of the other floors. Now, you would not need a badge to get to all of the other floors except for the second floor. On the second floor you had to badge in in order for the doors to open and be able to get into the office area, because it went directly into the office. There was not a secondary door there.

What happened this time is that the victim badged in, the doors opened, he stepped out onto the second floor and started continuing on. The adversary let the doors mostly close and at the last minute stuck their hand in so the doors could open back up. This made it so that the victim was already out of the room and did not realize what happened. So the adversary now had access to the first room. Now, in this room were a bunch of bikes that were being stored, so they stole one of these bikes.

The victim did not intentionally let this person in, so it was called tailgating. But this person was able to get in and steal a bike.

The Same Example As Piggybacking

Now let us see how we would turn that same example into piggybacking. In this case right here, maybe you had to badge in just to get into the elevator. And maybe this adversary right here has had some tools and some other stuff in their hands to make it seem like they were doing some maintenance within the building. So he steps up after this victim has already badged in and says, "Wait up for me. I need to get into this elevator because I need to go and do some work on one of the floors." And so now this victim holds the door open and allows this what appears to be a maintenance person, but instead is actually an adversary, to get into the elevator, and therefore getting into this locked area of the building. Now they are able to go around into the rest of the building, and in this case maybe steal a bike.

The Attack Cards

So here is the attack card for a tailgating attack, and essentially it is for an unauthorized person following an authorized person through an entry point without consent. Piggybacking is essentially the same thing, except that it is with consent. And so whoever is letting them through the door, the adversary through the door, they understand they are going through the door. It is just that they think that it is somebody that is supposed to be there.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →