What Is a Piggybacking Attack?
A piggybacking attack is unauthorized access to a restricted area, network, or system obtained by exploiting an authorized user's access rather than by defeating the access control itself.
In its most common physical form, an authorized employee knowingly allows an unauthorized person to follow them through a controlled entry point; that consent is what separates piggybacking from tailgating, where the intruder follows without the employee's knowledge.
How a piggybacking attack works
A piggybacking attack turns a legitimate access event into an unauthorized one. The attacker presents no badge, no biometric, and no smart card, relying instead on apparent authorization, which is why CNSSI 4009 classifies piggybacking as a form of spoofing (opens in new tab) alongside impersonating, masquerading, and mimicking.
NIST SP 800-53 Rev. 5 pairs it with tailgating in the access control vestibule (opens in new tab) control.
Because it targets human behavior rather than technology, piggybacking runs on a pretext. The ones documented in red team engagements include a delivery driver carrying fake invoices that name a real employee the attacker found on LinkedIn, a "new contractor, first day" who forgot their badge, an intruder with both hands full of boxes, or an IT support technician who looks the part.
The pretext works because it exploits social norms. Employees hold doors out of courtesy, and the brief window at an entry point leaves no time for identity verification. Attackers reinforce it with authority, posing as security or IT staff, and with urgency that compresses the target's decision below the threshold for verification.
Why piggybacking attacks matter
Physical entry is often the fastest path to full network compromise. The follow-on move falls under Hardware Additions (T1200) (opens in new tab) in MITRE ATT&CK: adversaries physically introduce networking hardware or a computing device as an access vector. In one red team engagement, testers placed a rogue device (opens in new tab) on a network switch in an unguarded closet; with no network access control in place, it immediately obtained an internal IP address and opened a remote connection to the testers' cloud VPN.
Real threat actors have crossed the same line. Beginning in April 2025 (opens in new tab), the Silent Ransom Group escalated from callback phishing and vishing attacks to sending operators physically into corporate offices posing as IT support to plant storage devices for data exfiltration.
The exposure is also regulatory. Physical-access requirements appear in PCI DSS Requirement 9, the HIPAA Security Rule at 45 CFR § 164.310 (opens in new tab), ISO/IEC 27001:2022 Annex A control 7.2, and SOC 2 criterion CC6.4.
Yet many enterprises still run physical security under facilities management while cybersecurity reports to the CISO, so physical breach data rarely feeds cyber risk assessments.
Types of piggybacking attacks
Piggybacking takes three forms, spanning physical and digital access:
- Physical facility piggybacking. An unauthorized person enters a restricted area on an authorized person's access, whether an employee waves them through, badges them in on a "forgot my badge" story, or lets them in out of courtesy. Once inside, attackers reach server rooms, network closets, R&D labs, and unattended workstations.
- Wi-Fi piggybacking. An outsider joins another subscriber's wireless network without permission. On an unsecured network, other users can monitor and capture (opens in new tab) web traffic or conduct illegal activity, and wardriving, searching for open networks by car, is a specific kind of piggybacking. In the United States, the Computer Fraud and Abuse Act prohibits unauthorized network access.
- Session and credential piggybacking. An attacker can also ride an authorized user's authenticated digital access: through an unlocked workstation, a shared password, or a stolen session token. Stolen OAuth and session tokens grant access without a new MFA challenge, because the identity provider has already authenticated them.
The formal NIST term for this technical variant is a session hijack attack (opens in new tab); "piggybacking" is the practitioner shorthand.
How to defend against piggybacking attacks
Because the attack spans physical and digital surfaces, the controls do too.
- Barrier controls. Access control vestibules with interlocking doors enforce one person per credential. Full-height turnstiles and speed gates do the same, and anti-passback rules stop users from handing a badge back for a second entry.
- Access policy and logging. Under NIST SP 800-53 PE-3 (opens in new tab), organizations verify individual authorizations at defined entry points and keep physical access audit logs; under PE-8, they also retain visitor access records and review them for anomalies.
- Visitor management. Escorted visits, expiring photo badges that distinguish guests from staff, host notification at sign-in, and deny lists close off the "invited guest" pretext.
- Network-side controls. IEEE 802.1X port-based network access control keeps a rogue device from getting a usable connection even after physical entry, and automatic session locking under NIST AC-11 and CIS Control 4.3 (opens in new tab) closes the unattended-workstation window.
- Training and a challenge culture. Employees need the vocabulary to politely challenge unbadged individuals, and staged tailgating spot-checks verify whether they will.
In one set of red team results (opens in new tab), a tester walked in behind a group unchallenged at one client, while staff at a client that had learned from past tests challenged the same tester at reception and several more times inside.
How Doppel helps
Piggybacking succeeds the moment an employee grants access without verifying who is asking, and that moment is rehearsed long before an operator reaches a lobby, across phone, SMS, and collaboration channels.
Doppel, the AI-native Social Engineering Defense (SED) platform, unifies Digital Risk Protection (DRP) and Human Risk Management (HRM). Its Simulation product emulates those multi-channel impersonation tactics, including live voice calls and deepfake-enabled scenarios, so employees build the challenge reflex before a real intruder tests it, and Security Awareness Training reinforces it with content drawn from live attacker tactics.
On the external side, Doppel's agentic AI correlates impersonation signals across channels through the Doppel Threat Graph and dismantles the attacker infrastructure behind hybrid campaigns, while human analysts handle the escalations that need judgment. Rehearsing the pretext and dismantling the infrastructure behind it make an organization too costly to attack through the people piggybacking targets.
Request a demo to test your workforce against the impersonation pretexts that piggybacking runs on.
Frequently asked questions about piggybacking attacks
What is a piggybacking attack?
A piggybacking attacker exploits an authorized user's access privileges to enter a restricted area, network, or system. In the physical form, an employee knowingly lets an unauthorized person follow them through a secured entrance. The term also covers digital variants, including using another person's Wi-Fi network without permission and access through an authorized user's active session or shared credentials. It is a form of social engineering that exploits human behavior and social norms.
What is piggybacking in cybersecurity?
In cybersecurity, piggybacking describes gaining access to a system or network by using another person's authenticated session or connection. Common forms include connecting to an unsecured wireless network without the owner's permission, using an unlocked workstation, exploiting shared passwords, and stealing session tokens that grant access without re-authentication. Stolen tokens are especially dangerous because the identity provider has already authenticated the session they represent, so they bypass a fresh multi-factor authentication challenge. The formal NIST term for this technical variant is a session hijack attack.
What is the difference between piggybacking and tailgating?
The difference is consent. In piggybacking, an authorized person knowingly allows an unauthorized individual to enter, for example by holding the door or waving a colleague through without a badge tap. In tailgating, the unauthorized person follows without the authorized person's knowledge, slipping through before a door closes. The two share the same physical-access control in NIST SP 800-53, but the countermeasures differ: sensors, vestibules, and detection systems counter tailgating, while policy enforcement and employee training counter piggybacking.
What is an example of a piggybacking attack?
A classic example: an attacker in a reflective work vest carries a large package toward a secured door, and an employee holds it open for them. Another common version is the "forgot my badge" story, where an attacker poses as a colleague or new contractor and asks an employee to badge them in. On the digital side, an example is a stranger connecting to a company's unsecured Wi-Fi network to capture traffic.