What's On Your Hotel Keycard

Lam1969 writes "From Robert Mitchell's blog on Computerworld: '... Wallace, IT director at AAA Reading-Berks in Wyomissing, Penn. has been bringing a card reader with him on business trips to see what's on the magnetic strips of his hotel room access cards. To his dismay, a surprising number have contained his name and credit card information - and in unencrypted form.' " Update: 09/20 19:10 GMT by J : Snopes, as of two months ago, says this is false.

Comments

This is why...

[Shkuey]

You always keep your keycards, and you always destroy them. I've yet to have an issue with a hotel wanting it back.

Re:This is why...

[Bensel]

Aha... here's the email I heard this from:

From the Colorado Bureau of Investigation:

"Southern California law enforcement professionals assigned to detect new threats to personal security issues, recently discovered what type of information is embedded in the credit card type hotel room keys used throughout the industry.

Although room keys differ from hotel to hotel, a key obtained from the "Double Tree" chain that was being used for a regional Identity Theft Presentation was found to contain the following the information:

a.. Customers (your) name b.. Customers partial home address c.. Hotel room number d.. Check in date and check out date e.. Customer's (your) credit card number and expiration date!

When you turn them in to the front desk your personal information is there for any employee to access by simply scanning the card in the hotel scanner. An employee can take a hand full of cards home and using a scanning device, access the information onto a laptop computer and go shopping at your expense.

Simply put, hotels do not erase the information on these cards until an employee re-issues the card to the next hotel guest. At that time, the new guest's information is electronically "overwritten" on the card and the previous guest's information is erased in the overwriting process. But until the card is rewritten for the next guest, it usually is kept in a drawer at the front desk with YOUR INFORMATION ON IT!!!!

The bottom line is: Keep the cards, take them home with you, or destroy them. NEVER leave them behind in the room or room wastebasket, and NEVER turn them in to the front desk when you check out of a room. They will not charge you for the card (it's illegal) and you'll be sure you are not leaving a lot of valuable personal information on it that could be easily lifted off with any simple scanning device card reader. For the same reason, if you arrive at the airport and discover you still have the card key in your pocket, do not toss it in an airport trash basket. Take it home and destroy it by cutting it up, especially through the electronic information strip!

Information courtesy of: Sergeant K. Jorge, Detective Sergeant, Pasadena Police Department

DMCA

[senducemhere]

The fact that he read his own information off of the card has to be a DMCA violation - he should get a lawywer now.

Really a big deal?

[DeadSea]

Your credit card contains your name and credit card number on it in an unencrypted form. If your key card does as well, you should treat it like a credit card.

1. It certainly would be nice for the hotel to tell you what they put on the card
2. They should tell you to report your credit card as stolen if you lose your key card.
3. They should securely erase or destroy key cards when you check out

I generally trust the hotel staff with my credit card number, and I generally acknoledge that there is info about me on the magnetic stripes in my wallet. Is this anything to get upset about?

Re:Really a big deal?

[stuckinarut]

You often hear about people that have had their ATM cards wiped by the magnets used to disable the security tags in stores. Many stores have 'Don't place cards here' signs to prevent this. If the hotels had 'Please place keycards here' on a similar magnet when you sign out then that would wipe them and problem solved.

Snopes claims this to be false

[Anonymous Coward]

http://www.snopes.com/crime/warnings/hotelkey.asp Who is right?

I have a card reader ...

[Anonymous Coward]

Let's see what the card says: "Housekeeping Notes: Customer uses excessive amounts of Kleenex on overnight stays ..." HEY!!!

Re:Illegal?

[Anonymous Coward]

Now admittedly this country has gone to hell, but why in the world would you think a card reader would be illegal?

That is incredibly depressing.

For the government, and its media cronies to have you in the state of mind where you feel that you should not have access to something like a card reader is sad and pathetic.

Information On Card

[Daveznet]

Why would the Hotel need to put straight Credit Card information onto the card? This doesnt make any sense. Why wouldnt they just use some sort of key to tie your swipe card to your account on their system. This way if you DO lose your card and it isn't cancelled in time someone who decides to use it can only use it within the Hotel where it can then easily be tracked.

I call BS...

[Julius X]

I've worked in a number of hotels for the past seven years- and all of them used electronic key systems, either the card type, or an electronic microchip key.

In EVERY case, the key system is a seperate box not tied into the main computer, and only contains your room number, and length of your stay. The device is ONLY a key coder - it does not tie-in to the main network or the hotel's database in any way.

This story is spreading FUD, do we really need more of that going around?

$1.50 card reader

[Anonymous Coward]

you can get one from all electronics corp for 1.50 yes one dollar and FIF-tee cents all electronics reader then use stripesnoop (.sf.net) and you can figureout how to hook them up to a gameport/whatever on their forum check their forum

You're kidding, right?

[swb]

I know a lot of people (including myself, until now) simply assumed the card had some magick code on it that opened the door, and once they checked out, the code stopped working, so key cards got:

1) left in the room when you walked out. There's probably a box on the cleaning carts where they get chucked. Highly insecure.

2) left in the rental car or wherever. You're done with it and presumably it has no information relevant to you.

3) idly thrown away (probably the most secure, provided its a sufficiently yucky trash can)

4) Taped to office doors or cube walls to make a "gee, I travel a lot" mosaic.

The idea that they're somehow secure because they MIGHT get stored and reused seems laughable.

Re:Wrong (Re:Snopes claims this to be false)

[millennial]

Let's keep reading, shall we? Snopes ACTUALLY says that none of the hotel chains they contacted put sensitive information on the cards. One reader who works at a hotel said that the only thing that goes on there is the room number, the number of nights in the stay, and the number of keys issued.

I remember this hoax . . .

[Rob the Bold]

It was a good one, too.

Here's the link: http://www.snopes.com/crime/warnings/hotelkey.asp

Tin foil hat time

[smallguy78]

Yes, I keep my hotel cards after I've checked out and destroy them in a vat of acid, burning the acid vat afterwards, then burrying the chard remains in 9 foot hole to be safe.

URBAN MYTH ALERT

[Thurmont]

Here are sites detailing this myth...

http://www.truthorfiction.com/rumors/k/keycards.ht m
http://www.breakthechain.org/exclusives/keycards.h tml
http://www.trendmicro.com/vinfo/hoaxes/hoaxDetails .asp?HName=Hotel+Key+Card+Hoax&Page=4

I'm surprised this one passed thru Slashdot's editorial staff.