Hotel Key Cards & Identity Theft
I just checked out of my hotel room in NYC after delivering an identity theft speech to the most wonderful New Yorkers at the Federal Reserve Bank of NY, and it reminded me of a question I hear constantly as I travel:
Can my identity be stolen off of the room key cards that hotels use?
In my experience, the answer is “no”. I have never found anything other than my name, room number and occasionally a customer number encoded on the magnetic strip on the back of the card.
Here’s how key cards work. Hotels store your personal information (credit card number, address, etc.) on their computer system rather than on the card. When they issue you your key card, they encode your name and the room number onto the card. When you use your key card at the hotel gift store or at the bar, it simply records that charge to your room or customer number. When you check out, the charge is billed directly to your credit card.
To verify the accuracy of my experiences, I researched hotel key cards on Snopes.com. Snopes is an excellent way to verify the truth of possible scams, frauds and urban myths. Snopes supports my findings, however…
Why take the chance? I’ve never been to a hotel that actually charges you if you don’t return the cards. So, the responsible privacy reflex here is to minimize your chances by destroying the card, even if it doesn’t pose much of a risk. Just like you should shred mail that only has your name and address on it (the first pieces of information an identity thief needs to uncover more identity on the Internet), so should you eliminate the chances that something on the hotel key card will ever be used to steal your identity. It costs you nothing and takes less than 30 seconds to CHOP. And in the meantime, this will get you in the habit of destroying identity exposure so that when it does count, you’re prepared.
Identity theft prevention isn’t about being paranoid, it’s about establishing good habits of privacy and being prepared.
John Sileo
Financial Identity Theft Speeches
Sorry, comments for this entry are closed at this time.
Connect with Sileo
The Sileo Report Newsletter Signup
Get monthly strategies and tips for protecting yourself and your business delivered right to your Inbox. Signup now and you'll immediately receive John's 7 Survival Strategies for Starving Data Spies!
3 Trackbacks/Pingbacks
12 Responses to Hotel Key Cards & Identity Theft
John: Suppose the hotel considers the card their property and you intentionally decide to keep it. Under Calif. law this could
be a felony. “….entering a building or dwelling with the intention to commit a crime. I think this is bad information.
Joe Steiner
Retired detective Napa County Sheriff, Calif.
541-956-8942
Instead of chopping the hotel key card, simply run a magnet across the magnetic strip on the key card just before checking out. The magnet will erase the
information on the caed. Then just give the card to the desk clerk. No questions about lost key card.
Hi John – more on the hotel key issue. I recently left my job in security for a Hyatt hotel. I can’t speak for other hotels, but we couldn’t even retrieve the room number off one of our “Saflok” keys – we didn’t the ability to read anything off the card. As far as I know, there is no personal information about the guest that can be retrieved off the key – the only info that gets encoded on the card is the room number and the checkout date (the card will no longer work after the encoded checkout date). Also, the system is set up so that if we make a new key, after the new key is used in the lock for the first time, the old key(s) will no longer work.
Of more concern to me was the practice of our hotel to place the room key(s) along with the guest’s receipt into a plastic “wallet” at check in time. Now, if the guest misplaces this “wallet” somewhere and hadn’t removed the receipt (with their name, room number, length of stay and last four digits of their credit card #) from this plastic “wallet”, a potential thief has all this info and the key to get into the room – in case the guest dropped it somewhere (or left it in the bar, which happened fairly frequently). Unfortunately, I rarely saw a guest remove the receipt from the “wallet”. There is another theft scam that is used with the information from this receipt. With receipt in hand, the thief will call the guest room from a house phone and identify himself to the guest as the manager and explain that there is a problem with the credit card. The unwitting guest will then proceed to read off his credit card number to who he thinks is the manager. And then it’s quickly off Macy’s!
My advice to hotel guests is to immediately remove the receipt from the plastic wallet and put it in a safe place. Also, no hotel I am aware of will EVER ask you for credit card information over the telephone. If there is some sort of problem requiring a phone call to the room, the manager will give you his/her name and ask you to stop by the front desk at your convenience. ALWAYS immediately report any strange phone calls or visitors to your room. Security will be immediately informed and will quickly contact you. If you misplace your key, contact the front desk immediately and they, after checking your ID, will make a new key – use this new key in your door lock right away so that any old keys will no longer work.
As to what to do with your key card after you check out: keep it as a souvenir or chuck it in the trash. No hotel reuses them and they won’t work after checkout anyway. If you’re extra paranoid, fold it in half or break it before you toss it away.
All hotels take security very seriously – I know ours did. Don’t be afraid to ask about any concerns you may have. The hotel security director will be happy to talk to you.
Adding to Michael Harer’s comment about using a magnet, I found that rubbing the magnetic strips of two key cards together will render the cards unusable.
In response to Joe, I have no idea what happens if they consider it their property. Given the ease with which we lose those key cards, I doubt the practicality of prosecution is pretty minor. I guess the middle ground is to take the suggestions above and demagnetize the cards and leave them in the hotel. Thanks for the question. John
Hi John: The key word to my response was “intentionally”. I once did a search warrant on the home of an employee of a Napa Valley
Resort and found several key cards in the home. The Resort difinitely felt the cards were their property and the employee was terminated
and arrested for possession of the cards as well as other charges. I do agree that the possibility of a hotel seeking this action
against a guest is remote unless the guest is a real jerk!!!
Joe
I have been involved in hotel management for over 20 years. The only
data on the key cards is the room number and check out date (guest name
is not on any keys that I know of). The key machine is separate from
the property management system. We do reuse all keys returned (and I am
sure that all other hotels do also). They are expensive. After the
programmed check out date, the key reads void and will not work
anywhere (or be readable – no room number or check out
date). No hotel will charge for keys taken by the guest. The front desk
does put the room number on the key packets (for all hotels). I have
never heard of a receipt being put in the packet. The only truth is
that key cards will be void if left against a cell phone. Everything
else is myth.
General Manager
Marriott
These cards are not expensive. They only cost around 6 cents a piece. Most hotels charge between $35 to $150 per night, so 6 cents is trivial. You run their air conditioner or faucet for extra five minutes in the room and it would cost them more than this, so this cost is trivially a joke.
I truly enjoyed reading through this article.Thank you.
Interesting article. Where did you got all the information from… 🙂
Great post. I never even thought about hotel key cards containing person information. I will never return one again.
This was presented as a problem so many years ago when my wife and I were travelling. At that time, carrying a small magnet with your gear was recommended and rubbing it across the magnetic strip of hotel room card before you handed it over when you left the hotel, supposedly rendered your card free of any personal information that had been added to your card.