Pretexting via Delivery Person is posing as a courier or facilities worker to gain entry, obtain information, or bypass security checks. Attackers exploit trust in routine deliveries to reach people, devices, or restricted areas. Defenders should challenge unplanned deliveries, verify badges and manifests, and escort unfamiliar visitors.
How Delivery Person Pretexting Works
Pretexting via a delivery person succeeds because the role is ordinary, time-sensitive, and socially familiar. Attackers use that expectation to reduce scrutiny, create urgency, and persuade staff to treat the interaction as routine rather than suspicious.
The technique is strongest when the target environment already expects couriers, contractors, or building services traffic. That lets the attacker blend into normal movement, start conversations, and use a believable reason for access without needing overt technical skill.
Why It Is Effective Against Physical and Information Controls
This pretext works because security controls often depend on human judgment at the edge of the environment. A badge, clipboard, package, or uniform can create enough perceived legitimacy to bypass a moment of caution, especially when reception, loading docks, or shared entrances are busy.
Its danger is not limited to entry. Once trust is granted, the attacker may observe workstations, overhear conversations, place a malicious device, tailgate into restricted space, or gather details that help a later intrusion. The same social engineering method can also be used to map procedures, shift patterns, and weak points in access handling.
Common Delivery-Related Pretext Signals
Delivery-based pretexting often includes small inconsistencies rather than obvious fraud. Examples include an unexpected arrival window, a vague recipient, a refusal to wait for verification, a request to bypass normal sign-in steps, or an attempt to pressure staff into solving a supposedly urgent problem on the spot.
It can also appear as a mixed physical and information request, such as asking who handles facilities, where equipment is stored, or whether a manager is present. Those questions are useful because they convert a simple entry attempt into reconnaissance about people, process, and location.
For a deeper look at the same social engineering family, see Vishing and Smishing Guide, which covers pretexting, impersonation, and verification habits that also apply when an attacker arrives in person.
Defensive Value of Verification and Visitor Discipline
The practical defense is to make routine verification stronger than the attacker’s story. That means staff should treat unplanned deliveries as exceptions, confirm the recipient and purpose through known channels, and avoid creating ad hoc access paths just because someone appears plausible.
Visitor handling also matters. Escort rules, manifest checks, restricted-area boundaries, and clear escalation paths reduce the chance that a delivery pretext becomes a foothold. The goal is not to make every interaction difficult, but to make policy-driven checks predictable enough that social pressure cannot quietly override them.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Delivery-person pretexting is a social engineering delivery vector used to deceive targets. |
| Recommendation — Map delivery pretexts to T1566 and reinforce verification for unexpected arrivals. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | Access decisions at reception and restricted entrances depend on authenticating visitors and contractors. |
| DE.CM-01 — Monitoring for Unauthorized Personnel, Connections, Devices and Software | Physical pretexting is often detected through monitoring for unauthorized people or devices in controlled areas. | |
| Recommendation — Apply PR.AA-05 to require verified access before granting entry or escorts. Use DE.CM-01 to watch for unapproved personnel and devices near sensitive spaces. | ||