How Safe Are Hotel Key Cards? by Robert J. Rebhan
My elderly mother who lives in Florida recently phoned me with “hot” information she read in a newsletter for seasoned citizens which she receives monthly. The article was about hotel entry/access key cards. “They are putting all your credit card numbers and other personal information on them, and you should never leave them at the hotel when you check out,” she warned.
This myth has circulated the web for the last few years, and there is no truth behind it.
The magnetic (“mag”) strip on all plastic cards (whether a credit card, debit card, gas card, hotel key, etc.) is essentially a short piece of reel-to-reel recording tape. Obviously, these tapes usually have information recorded on them. When a thief gets his or her hands on a "skimmed" (electronically stolen) account number (copied from a valid card using a skimming device*), he or she needs a vehicle to carry a stolen account number into a store. The credit card fraudsters know the account number can be electronically transferred and encoded (programmed) on any plastic card with a mag strip, overriding the original information. The card can then be used at any customer activated terminal in a grocery store, retail store, or even at an ATM if the thief has the personal identification (PIN) number for a debit card.
The panic involving hotel access cards started when a police officer in California arrested a thief who was involved in credit card fraud at retail stores. At the thief’s residence, the officer found a credit card fraud “laboratory” and hundreds of plastic cards. The officer, using an electronic card reader, found all sorts of stolen account numbers encoded on the mag strips of the cards found in the thief’s apartment. A few of the cards were hotel key cards. While presenting the case to the prosecutor’s office, the officer mentioned this to a district attorney who inappropriately assumed and announced to the world that all hotels were encoding their key cards with customers’ personal and financial data.
Under normal hotel operations, the key card is only encoded with the access code to a particular room or rooms at the hotel. When you check in, your credit card is swiped through a little box called an authorization terminal. This device is linked by phone wires to a financial company authorized to evaluate the transaction. When the front desk person gets the O.K., they take a blank hotel key card and slide it through a separate terminal which encodes a special numerical sequence of data allowing you into your particular room, and sometimes the spa, club lounge, etc.
I have been involved with the credit card industry and law enforcement for many years, and have monitored/analyzed “point-of-sale” operations for the lodging industry for twenty years, and there is no link between credit card authorization terminals and access key terminals.
Some resorts like Disneyworld and SeaWorld have special “closed loop,” or “linked” billing systems that allow park hotel guests to use the same card to charge purchases of goods and services in addition to the room charges to the guest’s account. From a consumer financial privacy standpoint, there is no problem with this because it is not, upon checkout, going to result in a piece of plastic floating around at the front desk with your credit card number on it. However, your name and some other inconsequential data is on the card, and if this bothers you, simply take the card with you upon checkout.
A Tip:
The card you should be worried about is the debit card, which is directly linked to your bank account and will remove funds from your bank account within minutes after you have made a charge to the card. Better to use a credit card and enjoy the “float period,” paying for your purchases a month down the road with a single payment. Credit card charges can always be disputed, but proving fraud on your debit card is harder. What motivation does the bank have to give your money back once it has been stolen from your checking account?
------------------------
*Skimming device: A small, battery-operated box used to electronically capture account numbers from plastic cards (credit cards, debit cards, etc.) by copying the data stored on the card’s magnetic strip as the card is slid through a slot in the box.
