← ACARA Digital Technologies Years 9–10

Physical social engineering: tailgating and baiting

Tricks that gain physical access: tailgating follows an authorised person through a secure door, and baiting leaves an infected USB drive for someone to plug in.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 32

Understanding Physical social engineering: tailgating and baiting in ACARA Digital Technologies Years 9–10

What it does: Following someone through a secure door before it closes is the core action of tailgating. A tempting, infected USB drive left for someone to find and plug in is classic baiting. Plugging in an unknown USB drive could install malware. Always hand it to the right person instead. Holding the door lets an unchecked person in. This is tailgating, so send visitors to reception. These are physical social engineering tricks. They rely on people, not on emails or online links. Shoulder surfing is spying on a screen or keypad to steal information such as a PIN or password. Pretexting means inventing a believable story or identity to gain trust and access.

Common mistakes: A stranger who follows staff through a secure door is tailgating. Baiting uses a bait item such as an infected USB drive. The line should be attack ← 'tailgating'. In baiting, the victim plugs in the infected USB drive. Plugging in a charger would not infect the computer. The line should be plug_in(work_pc, usb).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Physical social engineering: tailgating and baiting to a class →

This module's key terms are also in a printable crossword (Modules 782–809) and word search (Modules 743–809).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A stranger walks closely behind an employee and slips through a secure door before it closes. What is this called?
TailgatingPhishing
Matches
Found a USB drive in the car park, so plug it into a school computer to see who owns it.
↓
Plugging in an unknown USB drive could install malware. It should be handed to IT or security staff without being plugged in.
Applying
Meanings
Term
tailgating and baiting
Meaning
Tricks that gain physical access: tailgating follows an authorised person through a secure door, and baiting leaves an infected USB drive for someone to plug in.
Practice
IF person follows badge holder through door THEN
Testing
Gaps
if badgeValid peopleThrough == 1:
Check Answer
Spots
3stranger ← follow(staff)
4attack ← 'baiting'

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Arctic Hare' badge — Speed Indexer, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A stranger walks closely behind an employee and slips through a secure door before it closes. What is this called?
A. Tailgating ✓
B. Phishing
Tailgating means following an authorised person through a secure door to get physical access without permission.
2. Someone leaves an infected USB drive in a school car park, hoping a person will plug it in. What is this attack?
A. Baiting ✓
B. Tailgating
Baiting uses a tempting item, like a USB drive, to trick someone into letting malware in.
3. Which is the safest thing to do with a USB drive you find on the ground?
A. Plug it in to see who owns it
B. Hand it to IT or security without plugging it in ✓
Plugging in an unknown USB drive could install malware. Always hand it to the right person instead.
4. A visitor says 'Can you hold the door? I forgot my pass.' What should you do?
A. Hold the door open to be helpful
B. Politely direct them to reception to be signed in ✓
Holding the door lets an unchecked person in. This is tailgating, so send visitors to reception.
5. Which statement about tailgating and baiting is true?
A. Both trick people into giving physical access ✓
B. Both only happen through email links
These are physical social engineering tricks. They rely on people, not on emails or online links.

Match the Pairs

tailgating → Following an authorised person through a secure door without using your own pass or key.
baiting with a USB drive → Leaving an infected USB drive somewhere obvious so a curious person plugs it into their computer.
An attacker who sees a student swipe a pass joins them at the door. This is how tailgating gives physical access. → walk in behind the staff member before the door closes
An attacker wants someone to run malware, so they leave a USB drive labelled 'Exam Results' in the school car park. → USB drive labelled 'Exam Results' left in car park
Found a USB drive in the car park, so plug it into a school computer to see who owns it. → Plugging in an unknown USB drive could install malware. It should be handed to IT or security staff without being plugged in.
A stranger says they forgot their pass, so hold the secure door open and let them follow you in. → Holding the door open allows tailgating. The person should be sent to reception or asked to use their own pass.

Key Term

tailgating and baiting
Tricks that gain physical access: tailgating follows an authorised person through a secure door, and baiting leaves an infected USB drive for someone to plug in.

Fill in the Blanks

1. if badgeValid and peopleThrough == 1: openDoor()
Hint: Type the logical operator that needs both conditions to be true, so the door stays shut when a second person slips in behind.
2. if usbSource == "unknown": quarantine(usb)
Hint: Type the comparison operator that checks whether two values are equal, so a USB drive from an unknown source is isolated.
3. for person in behindMe: if person.watching: coverScreen()
Hint: Type the keyword that starts a loop, so every person standing behind you is checked for shoulder surfing.
4. usbFound = True if usbFound: print("Hand it to IT. Do not plug in!")
Hint: Type the built-in function that displays a warning message on the screen about a baiting USB drive.
5. caller = "IT support" if caller == "IT support" and not verified: refuseEntry()
Hint: Type the keyword that reverses a True/False value, so a pretexting caller is refused until their identity is checked.

Spot the Error

Question 1
A badge ← scan(staff)
B door ← open
C stranger ← follow(staff)
D attack ← 'baiting'
Line D — A stranger who follows staff through a secure door is tailgating. Baiting uses a bait item such as an infected USB drive. The line should be attack ← 'tailgating'.
Question 2
A usb ← infected_drive()
B leave(usb, car_park)
C staff ← pick_up(usb)
D plug_in(work_pc, charger)
Line D — In baiting, the victim plugs in the infected USB drive. Plugging in a charger would not infect the computer. The line should be plug_in(work_pc, usb).
Question 3
A stranger ← near(screen)
B IF stranger = true
C uncover(keypad)
D type(pin)
Line C — To stop shoulder surfing, you cover the keypad so nobody can see your PIN. Uncovering it helps the watcher. The line should be cover(keypad).
Question 4
A caller ← 'IT helper'
B story ← 'fix your account'
C give(victim, 'password')
D PRINT 'Pretexting'
Line C — In pretexting the attacker uses a made-up story to ask the victim for information. The attacker asks for the password, not gives it. The line should be ask(victim, 'password').
Question 5
A visitor ← at(door)
B IF visitor has a badge
C call(reception)
Line B — The check should catch visitors with no badge so reception can confirm who they are. Checking for a badge calls reception for the wrong people. The line should be IF visitor has no badge.

Student with a class code? Join your class →