Intercom Tailgating
A courier at the door is not an ID card.
What Is Intercom Tailgating?
A locked entrance only holds while the person answering the intercom actually checks. You watch one unverified buzz-in play out end to end, then take the call yourself: question a caller who cannot say who a delivery is for, weigh a hurried excuse against the one thing he will not tell you, and report the attempt so the next door on the block is already warned.
What You'll Learn in Intercom Tailgating
- Recognize that a badge reader only checks people who carry a badge, so whoever answers the intercom still has to verify the caller
- Trace what a single unverified buzz-in reaches once someone is inside, from an unattended whiteboard to a guest network key and a client list written on a wall
- Identify the tells that separate a genuine visitor from a pretext: a missing uniform, a missing badge, no delivery name
- Verify a caller's reason for entry by asking a direct question a genuine visitor answers without hesitating, rather than accepting an unverified excuse
- Decline entry when identity cannot be confirmed, even when the caller is impatient, sympathetic, or standing at the door during a known staffing gap
- Report an unconfirmed entry attempt to security immediately, so a description can be shared before the same person tries another door
Intercom Tailgating — Training Steps
-
Last Tuesday
The same notice from Facilities went round a week ago, and the same half hour went by with nobody on the front desk. Alice is at her desk. On the wall beside her the sprint board still carries this quarter's client list, and the guest wifi key somebody wrote up for a visitor in March and nobody ever rubbed out.
-
The Buzzer, Last Week
At 09:14 the wall unit starts buzzing. The feed shows a man in a plain jacket at the street door, a box held against his chest with both arms. Reception is out, so it falls to Alice.
-
Answer the Door, Last Week
Last week Alice picked up without thinking about it. A courier at the door during the reception gap is a Tuesday, not an event.
-
His Pitch
He talks fast, like someone with three more drops to make before ten.
-
What Alice Said
He has a box, he is in a hurry, and reception will be back in a quarter of an hour. Last week Alice answered the question he asked.
-
Open
Last week Alice pressed Open. Press it now, and watch the door downstairs click for a man nobody has checked.
-
Two Minutes
Alice goes back to her inbox. The man with the box does not come up to hand anything over, and nobody expects him to. He takes the stairs.
-
He Did Not Wait
Two minutes later he is on the third floor. No box now, no badge, and nobody at the desks with any reason to wonder who he is. The parcel was never the point. The door was.
-
The Board
He walks past the desks without stopping and stops at the board. Phone up, two photographs, about four seconds.
-
Gone
He puts the phone away and leaves the way he came in, at the same unhurried pace. Nobody on the floor looked up twice. The box, if there was ever anything in it, never arrived anywhere.
Security Framework Coverage
MITRE ATT&CK
- T1656 Impersonation
CIS Controls
- CIS 14.2 Train Workforce Members to Recognize Social Engineering Attacks
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind