November 10, 2026
Toukir Islam: Tailgating and Piggybacking — Social Engineering at the Door
The most hacked "system" in any building is not the badge reader. It is the polite employee holding the door. Tailgating — slipping in behind an authorized person — and piggybacking — talking your way in with them — account for more unauthorized entries than every technical bypass combined.
It works because it exploits courtesy. Someone approaches the door with their hands full, or in a hurry, or with a friendly "I forgot my badge." The employee, not wanting to be rude, holds the door. The intruder smiles, says thanks, and walks in. No alarm, no forced entry, no record.
I have watched this happen at commercial buildings, residential gates, and event checkpoints. The fix is cultural, not technical. Every person with badge access needs to understand one rule: your badge is your responsibility, and holding the door for a stranger is a security violation, not a kindness.
Here is what I teach. First, the polite challenge: "Can I see your badge?" said with a smile. Most legitimate people show it without offense. Second, the redirect: "The front desk can issue you a visitor pass — it is right this way." You are not accusing; you are helping them do it right. Third, the escort rule: visitors and vendors get escorted or badged, never waved through.
For guards on the door, the job is harder because you cannot challenge everyone aggressively without poisoning the atmosphere. The technique is friendly firmness. Greet everyone, check credentials visibly, and make it clear the checkpoint is real. A guard who waves people through to keep the line moving has surrendered the post.
Technology helps — turnstiles, mantraps, anti-passback programming on the badge system — but every one of those exists because humans hold doors. Train the humans and the technology becomes the backup instead of the only defense.
Delivery and vendor entrances are the forgotten front door. Drivers prop them open, vendors share codes, and after-hours deliveries bypass the main checkpoint entirely. Every vendor should sign in, show ID, and be expected — match them against the delivery schedule. Service doors get the same attention as lobbies. Some of the biggest insider thefts I know of walked out through a loading dock nobody was watching.
Toukir Islam — official website: https://toukirislam.com