Tailgating
A physical security breach where an unauthorized person follows an authorized employee through a secured door or checkpoint.
Definition
Tailgating, also called piggybacking, is a physical social engineering technique in which an unauthorized individual gains entry to a restricted area by closely following someone with legitimate access, such as walking through a badge-controlled door right behind an employee. It exploits courtesy and routine rather than defeating the access control system itself.
A tailgating attempt often looks completely ordinary: someone carrying boxes, wearing a plausible uniform, or simply walking confidently toward a door will find that employees hold it open rather than let it close on a stranger. Once inside, the intruder may plant a rogue device on the network, steal documents or hardware, or use the visit to gather information for a later social engineering attack. The attacker rarely needs to say anything, since the appearance of belonging is often enough.
This tactic matters because it bypasses badge readers, keypads, and other access control investments entirely, turning a technical safeguard into a matter of individual employee vigilance. Organizations with high foot traffic, such as bank branches, hospitals, and government service centers common across Indonesia, face elevated risk because employees are conditioned to be helpful to visitors and colleagues. A single successful tailgating incident can expose sensitive customer records, server rooms, or executive offices to an outsider.
Effective defenses combine physical controls, such as mantrap doors, turnstiles, and visitor badges, with a workplace culture where politely challenging an unrecognized person is expected and supported by management. Employees should be trained to ask 'can I help you find someone' rather than silently holding a door, and to report tailgating attempts rather than assume someone else will. Visitor logs and escort policies for guests and contractors further reduce the opportunity for this attack to succeed.
At a glance
- Severity
- Medium
- Prevalence
- Common in high-foot-traffic environments
- Primary targets
- Organizations with badge-controlled physical access, such as bank branches and government offices
- Also known as
- Piggybacking
How it works
- 1
Approach: an unauthorized person approaches a secured door carrying boxes, wearing a plausible uniform, or simply walking with confidence.
- 2
Courtesy exploited: an employee holds the door open rather than letting it close on someone who appears to belong.
- 3
Entry without verification: the intruder enters without presenting a badge or being challenged.
- 4
Action inside: once inside, they may plant a rogue device, steal documents or hardware, or gather information for a later attack.
- 5
Exit: the intruder leaves, often without anyone realizing access controls were bypassed.
Warning signs
- An unfamiliar person walking closely behind you through a secured door
- Someone carrying items or acting rushed to avoid badging in themselves
- A person who avoids eye contact or conversation when approaching a checkpoint
- Visitors without a visible badge or escort in restricted areas
- Anyone who seems to expect the door to be held rather than badging in
How to defend
- Ask "can I help you find someone" rather than silently holding the door
- Use mantrap doors, turnstiles, and visitor badges for physical access control
- Report tailgating attempts instead of assuming someone else will
- Require visitor logs and escort policies for guests and contractors
- Build a culture where politely challenging an unrecognized person is expected and supported by management
Real-world example
At a bank branch in Surabaya, someone carrying a stack of boxes approaches the staff entrance just as an employee badges in. The employee, wanting to help, holds the door open, and the stranger walks in without ever presenting identification, gaining access to an area with customer files.
How Claro helps
Claro's awareness content includes physical security modules on tailgating so employees understand it is acceptable, and expected, to question someone following them into a secured area.
Frequently asked questions
What is the difference between tailgating and piggybacking?
The terms are often used interchangeably. Some definitions distinguish them by consent: piggybacking implies the authorized person knowingly lets someone in, while tailgating implies they do so unknowingly, but in practice both describe following someone through a secured door.
Why does tailgating work even with badge readers installed?
It bypasses the access control system entirely by relying on human courtesy rather than defeating the badge reader itself, so the technology never gets a chance to stop it.
Is it rude to challenge someone following me through a door?
No. A simple, polite question like "can I help you find someone" is an expected and supported security practice, not an accusation, and organizations should train staff to see it that way.
What physical controls reduce tailgating risk?
Mantrap doors that only allow one person through at a time, turnstiles, visitor badges, and escort policies for guests and contractors all reduce the opportunity for an unauthorized person to slip in behind someone else.
Related terms
Social Engineering
The manipulation of people into revealing sensitive information or taking unsafe actions by exploiting trust, emotion, and human psychology rather than technical flaws.
Pretexting
A social engineering tactic where an attacker invents a false scenario to trick a target into revealing information or granting access.
Insider Threat
A security risk that originates from within an organization, such as an employee, contractor, or partner who misuses their legitimate access.
Zero Trust
A security model that assumes no user or device should be trusted by default, requiring continuous verification for every access request.
Reduce your human risk
Claro measures and lowers the risk these terms describe, in English and Bahasa Indonesia.
Request a demo