The man in the courier polo stood at the records room door of a private hospital in Lekki, both hands holding a stack of boxes, and waited. A nurse badged in, saw his full hands, and held the door. He thanked her by name, the one printed on the lanyard he had copied from a photo on the hospital's own Facebook page. Inside, he had four minutes alone with a workstation that was still logged in. No email was sent. No malware came through the firewall. He walked in because someone was polite.
The attacker who walks past your reception never triggers a single alert in your inbox filter. He triggers your courtesy.
Most security spending in Nigerian hospitals goes to the screen and the wire: email gateways, endpoint agents, the firewall the auditor asks about. All of it watches traffic. None of it watches the front desk at 7am during shift change, when the place is busiest and a stranger in scrubs draws no second look. Physical social engineering lives in that gap, and it is cheaper to run than any exploit. A printed lanyard costs less than a thousand naira.
// 01 Tailgating: the door someone holds for you
Tailgating is following an authorised person through a controlled door before it closes. It works because holding a door open for the person behind you is good manners, and good manners are hard to switch off at the badge reader. A hospital makes it easier than most. People move between wards all day. Lab staff, locums, agency nurses, the man who services the generator: nobody knows every face, so an unfamiliar one in the right clothes is invisible.
The fix is not a sign that says "do not tailgate", which everyone reads and nobody obeys. It is a habit you can teach in one toolbox talk: each person badges for themselves, and if you do not recognise the face behind you, you ask one question. "Who are you here to see?" That single line, asked without apology, ends most attempts on the spot. The attacker is counting on you not wanting the awkwardness. Take the awkwardness.
// 02 Pretexting: the story that gets the password
Pretexting is the invented reason. The caller is "from the EMR vendor", needs the admin to read out a password so they can push an urgent patch before the ward opens. The visitor is "the new biomed engineer", here to check the infusion pumps, and the supervisor who would confirm that is on leave. The whole craft is supplying a context plausible enough that verifying it feels rude.
The defence is a verification rule that does not bend for urgency or seniority. Identity gets confirmed through a channel the caller did not choose: you hang up and ring the vendor on the number in your own contract, not the one they gave you. No password is ever read aloud or typed into a form someone else is watching. Where the request claims authority ("the MD said to give me access"), the answer is that the MD's office confirms it, and only then. Pretexting collapses the moment one person refuses to be hurried.
// 03 The USB drop in the car park
Leave a few USB sticks where hospital staff will find them: the car park, the canteen table, the corridor outside the nurses' station. Label one "staff salaries Q3" in marker. Curiosity does the rest. Whoever plugs it in to see what is on it, often meaning to find the owner and return it, hands the attacker a foothold inside the network the firewall was built to protect. The device never came near the perimeter. It walked in a pocket.
Two controls take most of this off the table. Disable autorun and lock USB ports on clinical workstations through endpoint policy, so a found drive does nothing when inserted. And tell staff plainly what to do with a stray device: hand it to IT unopened, never plug it in to "check". The instinct to be helpful is exactly what is being farmed. Name it so people recognise it when it happens.
These three vectors share one root. Each turns a normal hospital virtue (helpfulness, deference to authority, the wish to return lost property) into the way in. Technology will not patch a virtue. A short, specific script will. Reception staff who can say "Who are you here to see?" and IT policy that makes a found USB inert do more, naira for naira, than another appliance in the rack.
- Tailgating beats the badge reader with manners. Teach one habit: badge individually, and ask "who are you here to see?" of any face you do not know.
- Pretexting beats urgency. Verify identity on a channel the caller did not supply, and never read a password aloud, no matter who is asking or how fast they need it.
- USB drops beat the firewall by arriving in a pocket. Lock ports and disable autorun on clinical workstations, and hand found devices to IT unopened.
- The target is a virtue, not a vulnerability. Helpfulness and deference are what get exploited, so the counter is a script, not a scolding.
- Reception is a control point. The front desk decides more about physical access than the firewall ever will.
Is your hospital vulnerable to social engineering?
We help healthcare organisations identify weaknesses, train staff, and build policies that stop manipulation before it succeeds.
Contact Us