M09-04 · Pretexting, baiting and tailgating

CEH M09-04 | Pretexting, Baiting, and Tailgating

Module 09: Social Engineering Read in sections; allow about 10–15 minutes.

1. The main idea: a plausible story, an attractive offer, and an open door are not authorization

M09-03 covered voice calls, text messages, and impersonation. Something that looks authentic is not necessarily verified. Today we take that idea further: an adversary may persuade someone to cross a boundary for them without using a fake website or an exploit.

Imagine working at the fictional Northstar learning center. Its office has controlled entry, and its computers contain private learner responses. A visitor says they are an urgently dispatched maintenance contractor. They carry a USB drive labeled “free course tools” and try to enter with an employee who has just used their badge.

Do not immediately conclude that the visitor is an attacker. This is a synthetic situation requiring verification. Separate three possible mechanisms:

• A reason: a story makes an unusual request seem reasonable.
• An incentive: something desirable encourages a particular action.
• Entry: someone uses another person's passage to skip their own access check.

The lesson is not to distrust everybody. It is to distinguish being helpful from skipping required procedures.

2. A knowledge map: three techniques, not a fixed attack sequence

The whole diagram scales proportionally to this column. Small screens also shrink its text; open the original SVG to zoom, or read the explanation below.

Reason, incentive, entry

Pretexting supplies a plausible story; baiting supplies an incentive; tailgating uses another person’s passage. They may occur separately or together.

Shared decision

Examine the requested action and the authority boundary. A convincing story, desirable offer, or open door does not authorize this action.

Relationship meaning

Dotted lines show conceptual associations, not time order, causation, or a mandatory attack sequence.

Open full-size SVGDownload SVG diagram

Figure 1 caption: The concepts connect to one central question: what action does the requester want me to perform? Concept links are not data transfers or a claim that every incident proceeds from a story, to bait, to physical entry.

These techniques can occur separately or together. M09-02 classified targets. M09-03 examined channels and claimed identities. This lesson examines reasons, incentives, and physical entry. These are different perspectives, not mutually exclusive labels.

3. Pretexting: build a story that makes the request seem necessary

A pretext is an apparent justification. Pretexting uses a fabricated or manipulated situation to make contact, a request for information, or an access request seem reasonable. The Canadian Cyber Centre likewise describes a false narrative used to build trust and seek information or access. Canadian Cyber Centre: Social engineering

The visitor might do more than claim to be a contractor. They add a justification: the manager wants the repair immediately, the contact is in a meeting, and registration can be completed later.

Separate two layers:

• Impersonation: who am I pretending to be?
• Pretexting: what story makes this request seem warranted?

They often overlap, but they are not identical. A person may invent an emergency without claiming a specific name. Real maintenance may also be urgent; urgency alone does not prove deception.

### Verify the person, the work, and its scope

Even if the company confirms that a visitor works for a real contractor, that does not authorize entry to every room or access to every file today.

Authentication checks the conditions needed to establish an identity. Authorization determines permitted actions. This is the same boundary introduced in M01-03 and M09-03.

Use an established trusted contact to check:

• 1. Is this work actually scheduled or approved?
• 2. Is this the designated person?
• 3. Which areas and equipment are included?
• 4. Are reception, escort, and activity records required?

The whole diagram scales proportionally to this column. Small screens also shrink its text; open the original SVG to zoom, or read the explanation below.

Receive a request

Do not immediately disclose information or change access. Leave contact information controlled by the suspicious source.

Independent verification

Use an established trusted directory or official service desk. Verify identity, request authenticity, and authorization for this object, scope, and time.

Two outcomes

If verified and authorized, perform only the necessary approved action and retain records. If inconsistent or uncertain, stop and refer. Arrows depict a defensive decision process, not data transfer.

Open full-size SVGDownload SVG diagram

Figure 2 caption: Arrows show a defensive decision process. Identity and work scope are separate checks. Limited execution follows only when the required checks satisfy the established procedure. Uncertainty goes to the authorized contact, not to an improvised approval.

Independent verification means using your established help desk, responsible contact, or system rather than relying only on contact details supplied by the requester. Australian guidance likewise calls for independent verification of requests to run code, change settings, or bypass controls. Australian Cyber Security Centre guidance

4. Baiting: persuade someone to perform the enabling action

Baiting uses an attractive promise or object to induce an action that benefits the adversary. It may appeal to curiosity, saving money, obtaining a tool, or fear of missing out.

The “free course tools” USB drive is a possible bait example. A free offer is not automatically malicious. Examine the source, the requested action, and what follows rather than deciding from a label alone.

Bait is not limited to USB drives. An unfamiliar “free assets” site might ask for a work account or an unapproved software installation. Baiting does not require malware: it may instead induce disclosure of information. Government guidance includes both malware installation and information disclosure as possible outcomes. Papua New Guinea NCSC: Social Engineering

### Separate the attraction from the consequence

Ask three questions:

• What benefit do I expect to receive?
• What must I first connect, open, install, enter, or disclose?
• Who might gain access to my device, account, or information through that action?

Different actions do not imply identical outcomes. Connecting a device, opening a file, allowing execution, and entering a password are separate events. Whether execution or access actually occurred depends on the device, system configuration, and evidence.

The whole diagram scales proportionally to this column. Small screens also shrink its text; open the original SVG to zoom, or read the explanation below.

Unknown is not proven malicious

An attractive free file or unfamiliar USB drive is not automatically trusted. Do not connect or open it on work or home devices as a test.

Safe response route

Report discovery and source information to the official contact, preserve and hand over as directed. Authorized specialists decide whether and how to analyze it.

Connections and risk

Green arrows mean reporting and referral, not plugging the USB into another computer. The red cross blocks an unsafe route; red dotted lines depict conditional risk, not established infection.

Open full-size SVGDownload SVG diagram

Figure 3 caption: An unknown source begins outside the trust boundary. The safe handling arrow leads to an approved intake and examination process, not straight to a daily-use computer. Dashed consequences are potential risks, not established events.

### Do not find an ordinary computer to “try” an unknown USB drive

Do not connect it to a work computer or take it home to test on a personal computer. Follow the organization's intake procedure. If analysis is needed, authorized people with appropriate expertise and an appropriately isolated environment should handle it.

A scan with no alert means the particular check did not detect a problem it could recognize. It is not an unconditional safety guarantee. This is an evidence principle, not a request to perform malware analysis.

Organizations can combine approved software sources, removable-device policies, appropriate device controls, and least privilege: granting only the access and capabilities required for the job. Least privilege can limit consequences, but does not guarantee that no incident can occur.

5. Tailgating: checking the person in front does not check the person behind

In this lesson, tailgating is unauthorized entry through a physical access boundary by following a legitimate user. This is not road traffic behavior or a synonym for network session hijacking here.

An employee's badge succeeds and the office door opens. A person carrying boxes wants to enter behind them. The open door is a physical state, not proof that the second person is authorized.

The University of Florida lists following someone, claiming a delivery, carrying large items, and claiming a forgotten badge among situations to examine. These appearances alone are not proof of criminal intent. University of Florida: Tailgating

The whole diagram scales proportionally to this column. Small screens also shrink its text; open the original SVG to zoom, or read the explanation below.

Two people, separate checks

The employee’s credential and entry are approved. The visitor’s identity and authorization remain unchecked; the visitor cannot inherit the employee’s permission.

Boundary and paths

The green arrow permits only the employee to enter. The visitor’s red route stops at the access boundary and refers to reception or access staff for verification, registration, and escort under policy.

Evidence limits

One valid badge event does not establish headcount or everyone’s permission. This is a teaching model, not an instruction to confront people; physical safety and checks follow site policy.

Open full-size SVGDownload SVG diagram

Figure 4 caption: The public area is on the left and the controlled area on the right, separated by an entry boundary. The employee passes their own check. The visitor requires a separate approved process. Arrows indicate people's movement, not file transfer or a confirmed system compromise.

### Tailgating and piggybacking

Some training materials distinguish tailgating from piggybacking according to whether the authorized person knows about or helps the entry. Terminology is not consistent across sources. The PNG NCSC lists them together, while the University of Florida's tailgating definition includes persuading authorized people to let someone in.

Do not treat the awareness distinction as a universal standard. If a question defines its terms, use that context. Operationally, ask whether the second person completed the required checks, who may authorize passage, and how their scope is limited.

### Protect the boundary without creating a confrontation

Use the organization's reception, visitor verification, registration, and escort procedure. Entry design may also include individual passage controls and alerts. If the situation feels unsafe, prioritize personal safety and contact security or the designated team. Do not physically block, chase, or confront someone yourself.

Individual verification does not mean every site needs the same equipment. Accessibility, emergency evacuation, work patterns, and applicable policies still matter. This lesson is a risk model, not a construction specification.

6. Put the techniques together without collapsing the evidence

Return to Northstar: the visitor gives an urgent maintenance reason, offers free tools, and wants to enter with an employee.

You can pause a high-risk action and seek formal confirmation without first proving that the person is malicious. But an investigation must not turn every suspicious sign into a confirmed attack.

Connections to previous lessons:

• M09-01: trust and helpfulness do not replace verification.
• M09-02/03: target, channel, claimed identity, and manipulation technique can all be described together.
• M01-01: entry may affect confidentiality, integrity, or availability; actual consequences require evidence.
• M01-02: risks can arise from visitor processes and permission design, not only software flaws.
• M01-03: real exercises require authorization. This is a tabletop lesson, not permission to test an unfamiliar office or leave USB drives for others to find.
• M01-06/07: people, procedures, entry controls, device controls, and records form defense in depth; incidents follow the response process.

7. Evidence: a record first supports the event it actually describes

One successful badge event does not prove that only one person entered. Access records usually describe credential and device events; they do not necessarily capture every person's movement. Confirming people and identity may require other lawfully and appropriately accessed records, reception information, and statements.

Likewise:

• Finding an unknown USB drive does not prove anyone connected it.
• A device-connection event does not prove every file executed.
• An execution event does not prove all data was exfiltrated.
• Physical office entry does not prove a protected-system login.

These are reasoning examples, not a claim that every product records the same fields. Keep observation, inference, and verification separate, as in M01-02.

Report suspicious activity through the established channel. Describe time, place, observations, and your actual actions. Preserve existing evidence. Do not open an unknown file to confirm a suspicion or arbitrarily erase records.

8. One visual reasoning check

Look at Figure 4. There is one successful employee badge event. The employee reports that a self-described maintenance visitor entered behind them and left a USB drive labeled “free tools.” Work approval, visitor authorization, device-connection records, and file-execution records have not yet been checked.

Use your own words to answer this single scenario:

• 1. Which movement or check cannot inherit the employee's authorization? Why does an open door not prove visitor authorization?
• 2. Which concepts might describe the maintenance story, free tools, and entry behind the employee? Can all of them already be labeled malicious?
• 3. What would you stop first, which trusted source would you consult, and what evidence would you seek?

A short answer is enough. Reference answers belong in a separate initially collapsed section. Publishing an answer is not the learner's response or evidence of mastery.

Reference explanation: 1. Which boundary cannot inherit the employee's authorization?

The visitor's path from the public area into the controlled area does not automatically become valid when the employee's badge succeeds. The employee's credential and rights belong to that employee. An open door is a device state, not proof of the visitor's identity, work approval, or permitted scope. A visitor might already have a legitimate arrangement, so check the process rather than judging from appearance.

Reference explanation: 2. Concepts and evidence

An invented urgent-maintenance justification may be pretexting. Free tools used to induce use of an unknown device may be baiting. Entry behind an authorized person without required authorization may be tailgating. They may coexist. However, missing work and visitor-approval evidence means there are risks to investigate, not enough evidence to declare every action malicious, code execution established, or data exfiltrated.

Reference explanation: 3. What to stop and what to verify

Do not use the unknown USB drive or provide additional information or access. Follow the established reception, responsible-contact, security, or IT process to verify work, identity, and scope. Prioritize personal safety; do not block or chase the person yourself. Preserve existing times, locations, and statements. Where authorized and necessary, correlate visitor records, access events and relevant video, device connections, and execution records. Those records may be absent or incomplete. Mark uncertainty instead of treating missing records as proof of no event or creating a new hazardous test.

Reasoning goal: identify the crossed boundary, seek evidence that can verify it, and act on the known risk. Guessing more attack labels is not a substitute.

9. Three lines to remember

• 1. Pretexting: a plausible reason still needs verified identity, work, and scope.
• 2. Baiting: examine the requested action; curiosity or a reward must not authorize risk.
• 3. Tailgating: another person's verification does not become your access right.

The next unit is M09-05, Insider Threats & Identity Theft. The aim is not to become unhelpful. It is to make helpful action safe and verifiable.

Download all four diagrams in Chinese and English (SVG ZIP)

Related reading: M09-01 · M09-02 · M09-03 · M01-01 · M01-02 · M01-03 · M01-06 · M01-07