Introduction

You probably work for a company or go to a school that uses something like a key fob or an ID card in order to enter the building, but how secure are they really?

During my first semester at university, I decided to test this and see how far I could get without using my ID card at all.

⚠️ Disclaimer: Everywhere I went, I had explicit permission to do so and could access the buildings via conventional means with my ID card. This was done as a controlled experiment to test security awareness, not to break rules.

The 100% Success Rate at the General Entrance

The general entrance was always the busiest, making it the easiest place to walk in unnoticed.

I could simply enter alongside a group of people.
Nobody questioned me when I followed others inside.
Once inside, I could access corridors, classrooms, and other blocks (STEM, Business, IT, etc).

Result: 15/15 successful entries.

What Happened at the Specific Entrance?

At one specific entrance, I still had a 100% success rate — but there was one notable interaction.

Once, when I needed to re-enter and nobody else was around, I knocked.
Reception opened the door for me without hesitation.
A passerby (not staff) asked if I was a student. I said yes and claimed I had lost my card.

That was enough. No verification was performed.

Result: 31/31 successful entries.

Classrooms

Later in the semester, I became curious about how easy it would be to get room availability information without an ID.

At the main reception, I asked about a room’s timetable.
When asked for my ID number, I said I didn’t have it.
When asked to check my email, I claimed my authenticator wasn’t working.
Despite this, I was still given the information with little suspicion.

Staff mentioned it might take longer to check, but they still provided the details.

The Library — The Only Failure

Unlike other areas, the library had proper access control in place:

To enter, you must swipe your ID at a turnstile (1-to-1 entry).
Following directly behind someone is nearly impossible.
The librarian’s desk faces the entrance, making piggybacking obvious.

Both the main and downstairs entrances enforced this system.

Result: Entry impossible without an ID card.

So What Does This Mean?

The main takeaway is that access without an ID card is far too easy in most parts of the university.

Tailgating was highly effective.
Reception staff rarely enforced strict verification.
The only effective access control existed at the library.

This inconsistency highlights a serious security risk. If someone with malicious intent exploited these weaknesses, they could access classrooms, offices, or other sensitive areas with little resistance.

Recommendations

Universities should:

Enforce stricter verification at receptions.
Train staff to challenge those without ID.
Educate students about the risks of tailgating.

Students should:

Avoid letting strangers piggyback in behind them.
Report suspicious behaviour at entry points.
Recognise that security controls exist for a reason.

End

This experiment showed that while ID cards can work, they are only as effective as the people and systems enforcing their use.

Until stricter measures are put in place, tailgating remains a trivial way to bypass security.