What does pretexting via delivery person look like in practice?

How a delivery-person pretext works on the ground

A delivery-person pretext works because it fits normal office behaviour. The attacker appears to belong, carries a parcel, clipboard, or uniform, and asks for help with a drop-off, signature, or access to a loading bay. The goal is to get close enough to observe routines, prompt someone to open a door, or reach an unattended workstation.

The strongest versions are social, not technical. The pretext may be used to create urgency, to avoid scrutiny, or to make staff feel rude for asking questions. In practice, the attacker often mixes a plausible delivery problem with a request that sounds ordinary, such as “Can you hold this while I check the manifest?”

What matters most is that the story is tuned to the environment. A hospital, corporate lobby, warehouse, or secure lab will each have different delivery routines, and an attacker will adapt the costume, language, and timing to match those habits.

What the attacker is trying to see or trigger

Delivery pretexting is usually a means to an end, not the end itself. A courier story can create tailgating opportunities, expose badge details, reveal who has access to restricted areas, or draw staff away from a desk long enough to view screens, tokens, keys, or paperwork left in sight.

It can also be a reconnaissance technique. The attacker learns where reception sits, which doors are propped open, who challenges strangers, and whether staff accept a package without verifying the recipient. That information can support a later intrusion, theft, or further impersonation.

If the site handles sensitive systems, the same momentary distraction can matter more than the visible access attempt. An unattended laptop, unlocked badge reader, or shared desk in a restricted zone may be enough to turn a harmless-looking visit into a security incident.

How defenders should handle courier-style social engineering

Delivery pretexts are best handled with simple, repeatable controls that reduce improvisation. Reception, security, and facilities teams should know who is allowed to receive deliveries, where they may wait, and what verification is required before anyone is escorted further in.

Good practice is to make the process boring and consistent. Require visitor registration, verify the recipient, keep deliveries in a controlled drop-off point, and escort outsiders instead of letting them self-navigate. Staff should also be trained to challenge unusual delivery requests even when the person looks legitimate.

Vishing and Smishing Guide is useful here because the same pretexting logic shows up across voice, text, and in-person impersonation, including package-delivery scams and verification tricks.

Risk and Threat Considerations

Delivery-person pretexting works because organisations often treat couriers as low-risk by default. That assumption can lead to tailgating, badge exposure, and short-lived but material access to restricted spaces, especially where reception and facilities processes are inconsistent.

Failure mechanism: The attacker exploits trust in routine logistics to bypass normal scrutiny, then uses the brief access window to observe, steal, or interact with assets that should have remained out of reach.

Impact: The result can be physical intrusion, information leakage, device compromise, or a foothold for later social engineering, depending on what was visible or unattended at the time.

Practitioner Guidance

What to verify: Check whether the site can actually distinguish a genuine delivery from a pretext at reception, loading areas, and side entrances. If staff rely on recognition or politeness instead of a defined process, the control is weak even if “everyone knows what to do.”

Common mistake: Treating visitor policy as sufficient without testing it against a live delivery scenario. The usual failure is not lack of awareness, it is inconsistency under pressure, especially when someone claims a time-sensitive drop-off.

What good looks like: Couriers are routed to a controlled handoff point, unknown persons are challenged near secure areas, and no one is expected to improvise access decisions at the door. A delivery pretext should be boring, contained, and easy to verify.

Practitioner takeaway: The real defence is not spotting every fake courier, it is making sure a convincing story cannot move an outsider from the public side of the building into a place where a brief distraction becomes a security event.

Related resources from NHI Mgmt Group

• What mitigations reduce the risk of pretexting via delivery person?
• Pretexting via Delivery Person
• What does SOC 2 Type I look like in practice?
• What does the TCP three-way handshake look like in practice?