Not every break-in happens online. Sometimes an attacker simply walks through a locked door behind an employee carrying coffee, or asks someone to “hold the door.” This is tailgating — a physical social-engineering trick that turns ordinary politeness into unauthorized access. Our GetMyPassword team explains what tailgating is and how to prevent it.
What tailgating is
Tailgating, also called piggybacking, is a physical security breach in which an unauthorized person follows an authorized one into a restricted area — an office, a data center, a secure floor — without their own valid credentials. The attacker relies on human courtesy and routine: holding a door for someone whose hands are full, slipping in behind a badge-in, or posing as a delivery driver, contractor, or new employee. Once inside, they can steal devices and documents, plug in malicious hardware, or access systems that all the firewalls in the world cannot protect from someone standing in the room.
Common tailgating tactics
- “Can you hold the door?” while carrying boxes or coffee.
- Posing as a delivery person, contractor, or repair tech with a uniform or props.
- Following closely behind someone who badges in, before the door closes.
- Claiming to be a new hire or visitor who “forgot” their badge.
- Exploiting busy moments, like shift changes, when no one checks.
Why politeness is the weakness
Tailgating works because confronting a stranger feels rude, and most people want to be helpful. Holding a door is a small kindness, and questioning someone in a uniform feels awkward — exactly the instincts an attacker exploits. The defense is not to be unfriendly but to make verification normal: everyone badges in for themselves, visitors are escorted, and “I don’t recognize you, can I help you find someone?” becomes a routine, expected question rather than an accusation. Strong physical-access culture turns courtesy back into safety.
An attacker in the room can bypass every firewall you own. Tailgating weaponizes good manners, so the fix is a culture where everyone badges in for themselves and a friendly “can I help you?” is routine.
How to prevent tailgating
Never hold a secure door for someone you cannot verify, and let everyone badge in individually. Politely challenge or report people without visible credentials, and ensure visitors and contractors are signed in and escorted. Organizations can add controls like access-controlled turnstiles, security cameras, and staff training. And because physical access often aims at the systems behind it, keep devices locked when unattended and every account protected with a unique password from our password generator and two-factor authentication.
Frequently asked questions
What is tailgating in security?
Tailgating, or piggybacking, is when an unauthorized person follows an authorized one into a restricted area without valid credentials, often by exploiting politeness — like asking someone to hold the door — or by posing as a delivery person or contractor.
Why is tailgating dangerous?
Once inside, an attacker can steal devices and documents, plug in malicious hardware, or access systems directly — bypassing digital defenses that cannot stop someone physically present in a secure area.
How do I prevent tailgating?
Have everyone badge in individually, never hold a secure door for someone you cannot verify, challenge or report people without credentials, escort visitors, and lock unattended devices. Access controls and staff training help at the organizational level.