I'm learning to become a Red Teamer, which simulates attacks by adversaries from multiple angles: Digital/Cyber, Physical and Social. This questions focuses on the Social Engineering aspect of Red Teaming, mainly what comes after engagements.
In Red Team engagements, we often interact with many people and social engineer then to do things like extract information, get unauthorized access, etc. As far as I know, such interactions often only last for a few seconds or minutes, sometimes a day or two. The chances of meeting the social engineered people after engagements are rare (how rare is it really?) but not non-existent.
When a PenTester/Red Teamer meets and talks with one of the people they've social engineered (tricked) outside of work and they recognize the PenTester/Red Teamer, they may ask things like "Hey you're that elevator guy from last week." or "You're the guy from Cisco! Can I get your number in case we get another problem?". In such cases, the profession was disguise and a lie.
If met with such interactions, what should the PenTester/Red Teamer do? Are there some policies and/or rules regarding such situations? Should we just lie to them and say "Yeah I work with elevators" or should we tell them something like "Oh I'm actually a Security Tester. That was a disguise"?
(I suppose we can tell them the truth but that may make it awkward and complicated. It may also make it harder if the next job happens to involve the same person.)