On Tuesday morning the side door by the kitchen is propped open with a folding chair, because the food pantry delivery comes on Tuesdays and the volunteers got tired of walking around to let the driver in.
At 9:40, a man in a polo shirt with a lanyard and a toolbox walks through it. He nods at the volunteer sorting cans — she nods back — and heads down the hall toward the office with the unhurried walk of a man who has been here before. He has never been here. In the next eleven minutes he will be alone with the office computer, the top drawer where the spare key lives, and the filing cabinet with last year’s giving statements.
Everything this series has covered so far arrives through a screen or a phone. This one walks in. Tailgating is the physical version of social engineering: following someone through a door they unlocked, or being let in because you look like you belong. Security people also call the polite variant piggybacking — where the victim actually holds the door — but the distinction doesn’t matter much in practice. The attack is the same: skip the lock by borrowing someone else’s trust.
Why a church is the easiest building in town
It’s worth being honest about this: a church is designed to be walked into. That is the point of the building. The signage says welcome, the culture says welcome, and on any given day the people inside include members, visitors, contractors, delivery drivers, twelve-step groups, tutoring programs, and someone’s cousin picking up folding tables. Nobody can say who “belongs,” because the honest answer is almost everyone.
CISA — the federal Cybersecurity and Infrastructure Security Agency, which runs a program specifically for houses of worship — frames the problem exactly this way: security planning for congregations has to work with “a congregation’s desire for openness and access,” not against it. The goal is not a church that interrogates strangers. The goal is a church where openness is a decision, not an accident.
And notice what the intruder in the polo shirt was actually after. Not the sound equipment. The office — because in 2026 the valuable thing in your building is data and access: the computer that’s still logged in, the passwords in the drawer, the donor records, the blank checks, the network jack behind the desk. Physical entry is how an attacker with no technical skills gets everything a hacker wants.
The four moves, so your team can name them
The borrowed opening. The propped door, the loading dock during an event, the stream of people arriving for a funeral. No deception needed — just timing. Big, emotional gatherings are ideal cover; nobody checks faces at a funeral.
The full hands. Boxes, coffee cycles, a ladder — anything that makes a decent person hold the door. The costume does the arguing: florist during a wedding week, HVAC in summer, “the piano tuner” any time.
The confident walk. No interaction at all. Enter during office hours, move like you have an appointment, know that the person who might ask questions will assume someone else already did. This is pretexting performed with posture instead of a phone call.
The advance call. The strongest version pairs both: a phone call Monday — “we’ll have a tech out Thursday for the fire panel inspection” — so that Thursday’s visitor is expected. Expected strangers get escorted to the electrical room and left alone.
What to do this week
Retire the propped door; give the regulars a better path. A door held open by a chair is an unlocked building with extra steps. Solve the reason it was propped: a doorbell at the delivery entrance that actually rings where volunteers are, a posted delivery window when someone staffs that door, or a keypad code for the food-pantry team that changes each season. People prop doors when the secure path is annoying. Make the secure path the easy one.
Draw the one line that matters. Most of the building can stay gloriously open. Pick the two or three spaces that can’t — the office, wherever records and money live, the room with the network equipment — and treat those doors as the perimeter: locked when unoccupied, every time, even for ten minutes. “Locked office, open building” preserves the welcome and removes the prize. Pair it with the screen-lock habit: an office computer left logged in behind an unlocked door is the whole breach, pre-assembled.
Replace suspicion with hospitality — literally. Train everyone on one move: greet the stranger. “Hi! Can I help you find something?” Warm, natural, entirely on-brand for a church — and devastating to a tailgater, whose whole method is moving unquestioned. A legitimate visitor gets directions. An intruder gets a decision point. Add the escort norm for anyone doing work in a restricted area: contractors are expected visitors with company, not wanderers.
Verify the advance call like any other pretext. “We’re sending a tech Thursday” gets the same treatment as every unsolicited contact in this series: call the company back on the number from your contract, not the number that called you. And keep a plain sign-in sheet for non-Sunday visitors and workers — not as bureaucracy, but so that “who was in the building Tuesday?” has an answer.
One more thing worth knowing exists: CISA offers houses of worship a free self-assessment guide and access to regional Protective Security Advisors who will walk your building with you, and FEMA runs a Nonprofit Security Grant Program that has funded exactly these kinds of improvements. You do not have to invent this from scratch.
The doors of the church should be open. That line is theology, and nothing here argues with it. But open should describe the sanctuary and the welcome — not the filing cabinet, the finance computer, and the drawer with the spare keys. Lock the three doors that matter, greet everyone else, and you’ve kept both promises.
The MissionDefend assessment covers the physical side of data protection — where records live, who can reach them, what’s locked — alongside the digital. Join the launch list for first access when it opens.
Sources: Cybersecurity and Infrastructure Security Agency, Protecting Houses of Worship; FEMA, Nonprofit Security Grant Program; Federal Trade Commission, FTC Announces Impersonation Rule Goes into Effect Today (April 1, 2024).