Tailgating security: what it is and how to prevent unauthorized access
Tailgating security sounds like something that should be easy to stop. Someone walks in behind an employee, the door closes, problem solved. Except that is exactly why it works. It is quick, awkward to challenge, and usually disguised as normal human behavior: holding a door, helping someone with packages, letting a vendor hurry in.
For offices, apartment buildings, medical facilities, warehouses, schools, retail properties, and commercial buildings, tailgating is one of those quiet physical security problems that can turn into theft, workplace violence concerns, data exposure, vandalism, or plain old confusion about who is supposed to be inside.
What is tailgating in security?
Tailgating in security is when an unauthorized person follows an authorized person through a controlled door, gate, lobby, or checkpoint to get into a restricted area. The person may walk in closely behind an employee, pretend to be a delivery driver, claim they forgot their badge, or act like they belong there.
The University of Florida describes tailgating as a social engineer trying to gain physical access by tricking authorized people into letting them in, with common tactics like following someone, pretending to have a delivery, carrying large items, claiming to have forgotten an ID, or pretending to be a custodian. The University of Florida’s tailgating guidance gives a simple list of those common tricks.
A basic example: an employee scans their badge at the office entrance. Before the door closes, someone behind them says, “Thanks, I’m heading to the third floor,” and slips in. The employee may not know them, but nobody wants to look rude. That tiny social pressure is the whole game.
Why physical security tailgating is such a problem
Tailgating is not just a door problem. It is a people problem, a policy problem, and sometimes a building layout problem.
A badge reader only works if one authorized person enters per badge scan. A locked lobby only works if visitors actually check in. A building access control policy only works if employees know they are allowed to question someone politely.
The National Cybersecurity Alliance gives a good example of physical social engineering: someone carrying two cups of coffee asks a passerby to let them into a secure building. They also recommend keycards, codes, biometrics, visitor escort policies, and staff training as ways to reduce physical security risk.
Once someone gets inside, the risk depends on the site. In an office, they may access work areas, unlocked laptops, files, server rooms, or employee-only spaces. In an apartment building, they may enter residential floors or package rooms. In a warehouse, they may reach inventory, loading docks, equipment, or staff-only areas.
Tailgating vs piggybacking
Tailgating and piggybacking are often used like they mean the same thing. In day-to-day security conversations, the difference usually comes down to awareness.
Tailgating usually means the unauthorized person slips in behind someone without that person realizing what happened.
Piggybacking usually means the authorized person knowingly lets the unauthorized person in, even if they are only trying to be polite.
NIST treats piggybacking and tailgating together when discussing access control vestibules, noting that unauthorized people may follow authorized people into controlled facilities. NIST SP 800-53 physical access control guidance also mentions interlocking door systems and guards as ways to control the number of people entering a secure point.
For a business owner, the fix is similar either way: one person, one credential, one entry. No badge, no entry.
How to prevent tailgating security issues
Tailgating prevention security works best when it is layered. You do not need to turn your workplace into a bunker. You do need to make unauthorized access harder, more obvious, and easier for employees to report.
1. Build a clear building access control policy
A building access control policy should answer the boring questions before something happens:
- Which doors are employee-only?
- Which entrance should visitors use?
- Who can approve vendor access?
- When are visitors escorted?
- What should employees do if someone tries to follow them in?
- What should security guards document?
- When should staff call police or management?
This should not live in a forgotten binder. Put the main rules where people actually need them: front desk instructions, tenant welcome packets, employee onboarding, guard post orders, and vendor check-in instructions.
If guards are posted at the property, tie the access policy into your security guard post orders. Post orders should tell guards who can enter, what to document, how to handle vendors, and what to do with denied entry situations.
2. Tighten the visitor check in procedure
A weak visitor check in procedure creates tailgating openings. People wander in because nobody knows where they should go.
A good procedure is simple:
- Visitors enter through one main point.
- Staff verifies the visit.
- Visitors sign in or are logged digitally.
- Visitors receive a badge or temporary pass.
- Sensitive areas require an escort.
- Visitors sign out or return the badge before leaving.
NIST says visitor access records may include names, organizations, signatures, forms of identification, dates, entry and departure times, purpose of visit, and the people being visited. NIST also recommends reviewing visitor access records and reporting anomalies. NIST’s visitor access records control is a useful reference for businesses that want a more formal process.
3. Train employees without making it weird
Security awareness for employees should be practical. People do not need a dramatic lecture. They need permission to stop doing the overly polite thing at secured doors.
A good rule sounds like this: “Please don’t hold secured doors for people you don’t recognize. Direct them to reception or ask them to badge in.”
That is enough for most workplaces. Employees should not argue, block, chase, or touch anyone. They should keep themselves safe and report it.
The FTC warns that scammers can trick employees into giving up sensitive information by pretending to come from a trusted source and using urgency or fear. That same idea applies at the door. Someone who “forgot their badge” or is “late for a meeting” may be using social pressure to get past access control. The FTC’s business scam guidance explains how attackers use trust and urgency to get employees to act too quickly.
4. Use access control best practices at the door
Access control best practices do not have to be complicated. Start with the doors people actually use.
High-risk entrances may need:
- Badge readers
- Door alarms
- Camera coverage
- Reception or lobby screening
- Visitor badges
- Locked stairwells
- Turnstiles
- Access control vestibules
- Security guards during busy hours
NIST recommends verifying access authorization before granting facility access, controlling entry and exit with access systems or guards, maintaining physical access audit logs, escorting visitors when needed, and securing physical access devices like keys, locks, biometric readers, and card readers. NIST SP 800-53 is built for formal security programs, but the basic access control ideas apply well to commercial buildings too.
For properties with repeated unauthorized access problems, our commercial security services can help support access control, front desk coverage, patrols, and incident response.
5. Fix the building layout problems
Some buildings almost invite tailgating.
Maybe the employee entrance is right next to a busy loading dock. Maybe the lobby desk is too far from the front door. Maybe tenants prop open side doors. Maybe the parking garage door stays open too long after each vehicle.
Walk the site and check:
- Which doors are propped open?
- Which entrances are not visible from the desk?
- Where do delivery drivers usually enter?
- Which doors have broken closers?
- Are employee-only signs clear?
- Are cameras pointed at useful angles?
- Do badges work the same way across all access points?
A walkthrough like this is exactly where a physical security assessment checklist helps. Tailgating is easier to prevent when you can see the gaps before someone takes advantage of them.
6. Document every unauthorized access attempt
Small incidents matter. One person tailgating through a side door may be nothing. Or it may be the third time this month and nobody noticed the pattern.
Document:
- Date and time
- Door or location
- Description of the person
- What they said or did
- Whether they entered
- Who was notified
- Camera footage availability
- Any follow-up action
A clean security guard incident report makes it easier to spot repeat problems and adjust staffing, signage, locks, cameras, or employee training.
What should employees do if someone tries to tailgate?
Employees should not physically confront or restrain a suspected tailgater. The safer response is to avoid holding the secured door, ask the person to check in at reception, and notify security or management right away.
A simple script works:
“Sorry, everyone has to badge in separately.”
Or:
“Reception can help you get checked in.”
No speech. No debate. No power struggle.
If the person keeps pushing, follows aggressively, threatens anyone, refuses to leave, or enters a restricted area, call security immediately. For serious threats, violence, break-ins, or refusal to leave after being told to do so, call law enforcement.
In California, Penal Code section 602 covers many trespass situations, including refusing or failing to leave certain property after being asked by the owner, agent, or person in lawful possession. California Penal Code section 602 also includes several rules for unauthorized entry into restricted areas and refusal to leave.
Security guards need to follow state rules, site policy, and training. California BSIS security guard training includes power to arrest, use of force, limitations on security personnel, trespass law, communications, and emergency response topics. California BSIS security guard training regulation is a good reference for how seriously the state treats guard conduct and limits.
Quick checklist for unauthorized access prevention
Use this as a starting point for workplace access control:
| Area | What to check |
|---|---|
| Main entrance | Is every visitor directed to one check-in point? |
| Employee doors | Do employees know not to hold secured doors for unknown people? |
| Badges | Are lost badges disabled quickly? |
| Visitors | Are visitors logged, badged, and escorted when needed? |
| Vendors | Is there a clear approval process before they enter? |
| Guards | Do post orders explain denied entry and tailgating response? |
| Cameras | Can you see faces at key entrances? |
| Reports | Are tailgating attempts documented and reviewed? |
| Training | Do employees know what to say and who to call? |
| Policy | Is the building access control policy actually used? |
FAQs
What is an example of tailgating?
An example of tailgating is when an employee scans their badge at a secured office door and an unknown person walks in right behind them before the door closes. The person may pretend to be an employee, delivery driver, contractor, or visitor.
What type of attack is tailgating?
Tailgating is a physical social engineering attack. It targets human behavior instead of software. The attacker uses politeness, distraction, urgency, or confidence to get into a restricted area without proper authorization.
What are the 4 types of security?
In workplace security, the four broad types are physical security, cyber or information security, personnel security, and operational security. Tailgating falls under physical security, but it can also create cybersecurity risk if the person gains access to computers, server rooms, files, or employee workstations.
What is tailgating vs piggybacking?
Tailgating usually means an unauthorized person slips in behind an authorized person without being noticed. Piggybacking usually means the authorized person knowingly lets that person in, often out of politeness. Many security standards and awareness programs use the terms together because both can lead to unauthorized access.
Can you call the police on a tailgater?
Yes, you can call the police on a tailgater if the person enters without authorization, refuses to leave, threatens someone, damages property, tries to access restricted areas, or creates a safety risk. For an immediate threat, call emergency services. For a nonviolent trespass issue, follow your site policy and use the appropriate non-emergency police process when safe.
How do I deal with a tailgater?
Do not grab, block, chase, or argue with a suspected tailgater. Do not hold the door open for someone you do not recognize. Ask them to badge in separately or check in at reception, then notify security, management, or the front desk. If the person is aggressive or refuses to leave, move to safety and call security or police.
Final thoughts
Tailgating security is not about making employees suspicious of everyone. It is about removing the awkward gray area at the door.
When your visitor access control process is clear, employees know what to say. When your building access control policy is written down, guards know what to enforce. When incidents are documented, managers can spot patterns instead of guessing.
The best tailgating prevention security plan is usually simple: one person per badge, visitors through reception, sensitive areas escorted, doors working properly, cameras placed where they help, and employees trained to report unauthorized access without playing hero.
If your property keeps dealing with unauthorized access, lobby confusion, after-hours entry issues, or unclear visitor procedures, ADS Guards can help build a practical plan around your site. Start with our commercial security services or request a quote.
