Lesson 1: What social engineering is
Social engineering means using lies, pressure or charm to get someone to give up access, information or money. The attacker often pretends to be someone you trust, such as a manager, contractor, delivery driver, police officer or IT worker. They may use details from social media to sound real.
Why guards are targets
Guards control doors, keys, access cards, alarm codes and visitor logs. They also know patrol times and which areas are empty at night. That makes a guard a valuable target.
Common pressure tactics
- Urgency: "I need this right now or the deal is lost."
- Authority: "I am the regional director. Just let me in."
- Helpfulness: arms full of boxes, waiting for you to hold the door.
- Fear: "Your account will be locked unless you act today."
- Rewards: a free gift, prize or service in exchange for information.
Lesson 2: In-person tricks
| Trick | What it looks like | What to do |
|---|---|---|
| Tailgating | Someone follows an authorized person through a secured door without using their own card | Stop them politely and ask them to badge in or sign in |
| Piggybacking | An employee knowingly holds the door for someone without access | Remind staff that every person must badge in, and report repeats |
| Pretexting | A made-up story, such as a fake inspector, contractor or courier who "needs" access | Check ID and verify with the client contact using a number you already have |
| Shoulder surfing | Someone watches you type a code or password | Shield the keypad and screen; change the code if it may be known |
| Baiting | A USB stick or gift left where someone will pick it up and use it | Do not plug it in; hand it to IT or your supervisor |
Holding firm, politely
Attackers count on people wanting to be helpful and avoid conflict. You can be friendly and still follow the rules. Use calm, simple words: "I am happy to help. I just need to confirm this with your contact first." If the person gets angry or keeps pushing, that is a reason to be more careful, not less. Write down what happened and report it.
How to verify a visitor
- Check the visitor list or work order for the name and date.
- Check photo ID and compare it to the person.
- Call the host or client contact using a known number from your post orders, not one the visitor gives you.
- Sign the person in, issue a visitor badge and escort them if required.
- If you cannot verify, politely refuse entry and report it.
Lesson 3: Phone, email, text and QR code scams
| Name | How it arrives |
|---|---|
| Phishing | Emails pretending to come from a trusted source |
| Spear phishing | A message aimed at one person or a small group, using real details |
| Vishing | Phone calls or voicemails, sometimes with a spoofed number or an AI copy of a real voice |
| Smishing | Text messages |
| Quishing | QR codes that lead to fake websites |
| MFA fatigue | Repeated login approval prompts until someone taps "approve" |
Warning signs
- You did not expect the message, and it has links, attachments, a login page or a QR code.
- The sender's address or website name is slightly off.
- It asks for passwords, codes or personal details.
- It uses threats or urgent language.
Banks and government agencies do not ask for sensitive information or send account links in messages you did not expect. Hover over a link to check where it really goes before you click.
Lesson 4: Protecting site information
Treat these as sensitive: alarm and door codes, post orders, patrol times, key and access card records, camera locations, visitor logs and any personal information about tenants, staff or visitors.
Canada's private-sector privacy law, PIPEDA, says personal information must be protected by safeguards that suit how sensitive it is. Safeguards include physical measures such as locked filing cabinets and restricted access to offices, which are often a guard's job.
- Lock your screen and log out when you leave the desk.
- Keep logs and reports out of public view.
- Do not post photos of the site, badges, keys or schedules on social media.
- Do not share client details with friends or strangers, even casually.
- Shred papers with personal or site information when your employer says they can be destroyed.
Lesson 5: Reporting an attempt
Report every attempt, even if it failed. One report can warn the whole team.
- Do not reply to the sender or call back the number they gave.
- Save the message or write down what was said, by whom and when.
- Tell your supervisor and the IT or security team right away.
- If you clicked a link or entered a password, say so. Change the password and turn on multi-factor authentication if you can.
- If money or information was lost, contact local police, then report to the Canadian Anti-Fraud Centre online or at 1-888-495-8501.
If personal information may have been exposed, your employer may have legal duties. Under PIPEDA, an organization must report a breach that creates a real risk of significant harm to the Privacy Commissioner of Canada, notify the people affected and keep a record of every breach. Quick, honest reporting by staff makes this possible.