Tailgating is following an authorised person through a controlled door without their knowledge. Piggybacking is the same entry with their knowledge, usually because they were persuaded to hold the door open. The difference is consent.
That distinction decides which control applies. Tailgating is a physical problem solved by turnstiles, mantraps and door sensors. Piggybacking is a social problem, because the employee actively helped, and no sensor prevents a person choosing to be polite.
Documented cases
- Rapid7 documents piggybacking precisely: a tester used door-holding reciprocity and a badge that merely looked plausible, then a new-employee pretext at the help desk.
- GAO investigators entered federal buildings using fake law-enforcement credentials across a decade of tests.
- Saudi Aramco shows physical access being used as the entry point to a destructive intrusion.
The control that breaks it
- Use turnstiles or mantraps that admit one badge, one person. This removes both variants at once.
- Tell staff explicitly that holding a door is not courtesy here, and give them a script to redirect visitors to reception.
- Make badges visually verifiable at a glance, since a plausible-looking badge was enough in the Rapid7 test.
- Alert on badge-in events with no matching badge-out.
Related: how to prevent tailgating · Physical social engineering
Related
Social Engineering Examples