What is a tailgating attack?
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Definition
A tailgating attack is when an unauthorized person follows an authorized one through a secured door or gate to get into a restricted area without their own access credentials.
- Category
- Attacks
- Also called
- tailgating, piggybacking
- Last updated
Sources checked: cisa.gov, nvlpubs.nist.gov
Last verified against the official page:
Tailgating is a physical social engineering attack. The attacker doesn't break a lock or hack a badge reader. They wait for someone with access to open the door, then walk in behind them. CISA describes it as a physical security breach, also called piggybacking, in which an unauthorized person follows an authorized individual into secured premises. NIST's SP 800-171 lists tailgating among social engineering techniques, next to phishing and pretexting.
How it plays out
Say an office door needs a badge. Someone in a delivery jacket arrives with a box in both hands as an employee is going in. The employee holds the door out of politeness. The stranger is now inside, near desks, unlocked screens and printers. Researchers note that tailgating is often combined with impersonation, such as posing as a courier or technician.
The goal can be theft of equipment or documents, plugging a device into the network, reading what's on a screen or looking for ways to a more valuable target.
Tailgating vs. piggybacking
Some sources use the words interchangeably. Others split them: in tailgating the authorized person doesn't notice, and in piggybacking they knowingly let the other person in, often out of courtesy. Either way the result is the same: a person gets through a control that was meant to check them.
Why it matters at home too
It isn't only an office problem. Apartment buildings with shared entrance doors, gated communities and co-working spaces all rely on people not letting strangers in behind them. A stranger who gets into your building can reach your mailbox, your parcels and your door.
How to protect yourself
- 1
Check who is behind you
Make sure the door closes behind you before you walk on. If someone follows you in, it's fine to ask them to badge in or buzz their own way.
- 2
Be politely firm with strangers
If someone you don't know asks you to hold a secured door, say you can't and point them to reception or the buzzer. Real couriers and visitors have a way in.
- 3
Report doors that don't latch
Tell building management or security about propped doors, broken closers and gates that stay open.
- 4
Keep devices locked
Lock your screen when you step away, and keep laptops and documents out of sight, so a person who gets in finds little.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between tailgating and piggybacking?
Many sources treat them as the same. Others say tailgating happens without the authorized person noticing, while piggybacking means they knowingly let the other person in, for example out of politeness.
Is tailgating illegal?
Entering a restricted area without permission can amount to trespass or a related offense, and the rules depend on where you live. If you work somewhere with access control, tailgating is also usually against company policy.
Is tailgating a cyber attack?
It's a physical attack, but it is classed as social engineering because it relies on manipulating people. It often leads to digital harm, such as someone plugging a device into a network or reading a screen.
Sources
Something wrong or out of date? Tell us and we'll re-check it.