Intercom Tailgating
A courier at the door is not an ID card.
What Is Intercom Tailgating?
A stranger at a locked entrance does not need to break in if whoever answers the intercom simply buzzes them through. In this exercise you answer a ringing intercom, question a caller who cannot say who a delivery is for, and decide whether a full pair of hands and a plausible excuse earn access to the building. You practise reading the tells that separate a real visitor from one testing the door, and reporting an attempt so the next door is already warned.
What You'll Learn in Intercom Tailgating
- Recognize that a badge-controlled entrance only verifies people already inside, so whoever answers the intercom still has to verify the caller
- Identify the tells that separate a genuine visitor from a pretext: a missing uniform, a missing badge, no delivery name
- Verify a caller's reason for entry by asking a direct question a genuine visitor answers without hesitating, rather than accepting an unverified excuse
- Decline entry when identity cannot be confirmed, even when the caller is impatient, sympathetic, or standing at the door during a known staffing gap
- Report an unconfirmed entry attempt to security immediately, so a description can be shared before the same person tries another door
Intercom Tailgating — Training Steps
-
A Notice From Facilities
It's just after nine on an ordinary Tuesday morning. Alice is at her desk at Verrowick Media, working through her inbox with a cup of coffee going cold beside the keyboard. An email from Facilities lands: reception will be unstaffed for half an hour while the front-desk team trains. It has happened often enough that nobody on the floor thinks twice about it.
-
The Buzzer
At 09:14 the wall unit beside Alice's desk starts buzzing. Reception will not be back for another sixteen minutes, and the entry camera shows someone waiting at the street door with a parcel.
-
Answer the Door
The feed shows a man in a plain jacket with a cap pulled low, holding a box against his chest with both arms. No van in view, no uniform, no company markings on the box.
-
The Pitch
He talks fast, like someone in a hurry to be somewhere else.
-
What Do You Say?
He wants the door. He has not said who the delivery is for, and reception, the desk that would normally check that, is empty for another quarter of an hour.
-
An Evasive Answer
The question catches him off guard.
-
Look Closer
Before deciding anything else, look at what the camera actually shows: no uniform, no company name on the box, no badge clipped to his jacket, and no name for who the parcel is even addressed to.
-
The Tells
None of this proves anything by itself. Couriers really do turn up unannounced, in a hurry, with their hands full.
-
The Answer
Reception is back in fifteen minutes. There is no reason a real delivery cannot wait that long at a locked door.
-
Decline
He has no badge, no van, no company markings, and no name for who the delivery is for, only an excuse for each one. Buzzing him in trades your own access for his convenience.
Security Framework Coverage
MITRE ATT&CK
- T1656 Impersonation
CIS Controls
- CIS 14.2 Train Workforce Members to Recognize Social Engineering Attacks
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind