Slashdot Mirror
Hotels Lead the Industry In Credit Card Theft
katarn writes "A study released this year found that, of the credit card hacking cases last year, 38 percent involved the hotel industry. At hotels with inadequate data security, the greatest amount of credit card information can be obtained using the simplest methods. It doesn't require brilliance on the part of the hacker. Most of the chronic security breaches in the hotel industry are the result of a failure to equip, or to store or transmit this kind of data properly, and that starts with the point-of-sale credit card swiping systems."
Hotels lead the industry in credit card theft.
Wait...which industry? The hotel industry? So hotels lead the hotel industry in credit card theft?
Redundant statement is redundant. Or poorly worded. Or just plain stupid.
Living With a Nerd
What was not mentioned in the article is that some of this may be caused by the hotel staff. The folks who work the night shift are frequently underpaid and have a bunch of spare time to browse through the credit card numbers and transactions of the folks who have checked in that evening.
Tisha Hayes
Based on the article, it appears to mean that 38 percent of the fraud across all merchants that take payment cards involves a hotel. So the "hotel industry" is responsible for 38 percent of payment card fraud in "industry" in general.
This would be avoidable except the fuckers require a credit card to get a room.
Still waiting for the the liability laws to reflect the part poor security of issuers play in this, and distribute liabilty accordingly.
I recently had a hotel leave one of those quick check-out forms partially slid under my door. The problem was that it had my credit card information printed on it. It would have been quite easy to walk down the how and grab a dozen names, credit card numbers and expiration dates. On top of that, who knows what happens to the forms once you sign them as I highly doubt they go through a shredder.
ÕÕ
Unprotected WIFI with default-passworded routers?
they can also clone your card to a room key as well if they want to I don't think they do that by default any more.
Obviously, at the time of transaction, the CC info is needed to make the transaction, but why do they retain the info after that? Don't the credit card networks issue a transaction ID for every transaction? If, after a transaction, the hotel needs to do something like refund part or all of the charge (e.g. returning a deposit), it would seem like they should be able to do that with just the transaction ID. Is there something I'm missing?
This, it seems to me, applies to almost every merchant - retail, dining, entertainment, services, hotels, whatever. Why do they need to retain the info?
If the end-user is not responsible, and this all becomes the responsibility of the credit card networks and banks, then I suppose I don't care too much, but if this can end up adversely affecting the credit reports of the victims, then I think the credit card industry needs some reform, beginning with mandates that info not be retained by merchants. A hacker can't steal what isn't there (although, a hacker could still potentially capture the CC info in real-time at the moment of the transaction, but at least you've reduced stored-data attacks).
Most room keys do not offer a mag-stripe that is capable of holding all 3 tracks of CC data properly...
I recently stayed at a cheap chain motel while traveling for a softball tournament. They had a sign posted (in the disused lavoratory, etc.) along the lines of:
Theft is a problem. We have a safe in your room. If you use it and someone steals your stuff, we'll insure you up to $10,000. For your convenience, a $1.50 charge will be added to your bill for the rental of the safe. If you don't want to pay the charge, let us know and we'll remove it.
(Part in bold is as verbatim as my memory allows.)
When I checked out the next morning, I asked the clerk to remove the $1.50 fee. She kind of huffed, spent the next 5 minutes messing around with the computer, then gave me a receipt for the correct amount that I expected to pay. Two days later, I noticed that my online statement was off $1.50+tax. Sure enough, they'd charged me anyway. When I called them to say that I wanted it fixed - yes, I am that stubborn and nitpicky - they assured me that this never happens and they were so sorry.
As cheap as the motel was, that was an extra 3% or so in automatic free revenue. If they're operating at a 10% profit margin, that's about a 66% increase in actual profit. How many times to people look that closely at their credit card bills? I'd be willing to bet that 99 times out of 100, people see that the charge was correct to the nearest $10 and don't check it to the penny, or they figure it's not worthwhile and don't follow up on it.
Dewey, what part of this looks like authorities should be involved?
I'd just like to thank the author for not using the ridiculous term 'identity theft'.
They have never done that as default. Honestly, where do people get that idea?
Things that are bad... POS machines on the same subnet as the Guest WLAN...
Wouldn't it just be easier to have some blank mag-stripe cards? One of the local computer stores sells them for $60 for a 25 pack.
Hackers often target hotel pbx systems to call rooms and "confirm" credit cards with people staying there.. Its one of those big issues you never hear about until someone is caught and its easily done since 99% of the hotel rooms don't offer any caller-id functionality. So if you get a call while in a room to confirm your credit card, just ask to go downstairs and confirm at desk.
Although it was about traveling outside the country.
He was teaching the Networking course, and during a brief section on security and encryption he mentioned how he had recently been traveling (he wouldn't say where, but he was born in India) and stayed at a five-star hotel while he was out of the country. He then pointed out how he had requested a new/temporary credit card from his bank for the trip, which he only used to pay for the hotel, and he canceled the card as soon as he was back in the US.
By the time he had gotten back to the states, the card had already been stolen/compromised.
I remember years ago I drove around a little with my laptop on the passenger seat recording the SSIDs I'd passed. Always fun to see how people name things. One that stood out was a Pik N Save or something... they strangely had a Wifi setup but the name was.
PIKSAVPOS
Yeah, their Point of Sales network was unencrypted and accessible throughout the huge parking lot and onto the main road.
Nice.
Perhaps the hotels used the same contractor. Very cheap and fast setup, works great.
Cwm, fjord-bank glyphs vext quiz
So you have all these names and numbers. Then what? As far as I know, online stores only ship to the address on the card. I.e. not where you live.
I fail to see how you could benefit from having just these numbers and not also having control over the residence of the card owner. Care to enlighten me?
Do the credit card companies care yet? when my friend's identity was stolen a few years back, they had no interest in finding and prosecuting those responsible, even when he did the research and found them. It was cheaper for them to just pay him off and forget about it. So if it's a no-risk crime, then it doesn't matter which industry leads the ... uh... industry. I'd prefer to see how many such crimes are solved and prosecuted successfully.
Currently hooked on AMP
The night auditors would go through the thousand or so CC slips, and using CC software on a PC, pull up the authorization by CC Number and enter the final amount.
Anyway... long story longer... we had access to many, many credit card numbers every night.
At least at our hotels, the early check out forms left under the guests' door did not contain CC info.
I had a business trip there about 15 years ago. About a year later, I got a snail mail birthday card greeting from the hotel. I thought that is was kind of cute, and mentioned it to another colleague who often traveled to Geneva at that time. He is a security weenie, and told me:
Just think what will happen when the hotel retires their PC, and gives it to a child of one of the employees, without scrubbing the disk.
There goes your name, credit card number, and birthday info . . .
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Most room keys do not offer a mag-stripe that is capable of holding all 3 tracks of CC data properly...
They don't need to create new, valid-looking cards on-site. Besides, all the fun stuff is replicated in tracks 1 and 2.
The room-key card system could provide a means of swiping (hah!) customer credit cards that doesn't require the same level of auditing that the actual payment systems should have. That could give them an easy way to grab the data for later.
That's what happens when you have a cheap owner and your not PCI compliant....(Thanks Miracle Springs Resort).
There are two ways to steal credit card numbers: getting them from a computer system of some kind (up to an including things like putting a stripe reader on the front of an ATM) and the old-fashioned way of a clerk or waiter or whoever just looking at a card and copying the numbers. Does anyone know of any data showing which is more common?
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
There are almost no hotels that let you stay without a credit card, so it makes them a prime target as every transaction has to have a credit card, even if in the end you use cash to pay for the stay. I feel sorry for the portion of the public that refuses to use plastic, and only uses cash. I realized this early on in collage when I had to stay in my car since no hotels would accept cold hard cash.
I used to do IT for a large luxury resort, and this was one of the things that was always on my mind. They had an extremely expensive, quirky, and bug laden PMS (Property Management System). It did everything on the resort grounds from scheduling on the golf course to restaurant outlets (pos) to guest reservations. Once I started digging into it I realized that it had ~7 years worth of all of our customers data- credit card numbers etc etc. I wanted to archive all of that data in a safe (or destroy it) but in order to do so we would have had to spend way more $ than we had in the budget to upgrade to the latest version of the PMS with a new, clean database. (Parts of it were largely remotely administered, since the majority of the important parts of the software were password protected by a code that changed every 15 minutes, and they routinely changed the algorithm that produced the code.)
All of that information could have fit on a DVD several times over (just an SQL DB). I am used to being in positions of responsibility, but to me this was a huge disaster waiting to happen, and it brought clarity to my opinions into just how important it is to have an IT person with high moral standards. Nevertheless, all it takes is one unscrupulous person anywhere in the loop to cause massive trouble to others at very little effort on their part.
I recommend that you only pay cash, for everything, if at all possible. I mean, if that data from the resort would have gotten lifted by someone that sold the information, noone is going to have a clue that their information was obtained from their stay at a random resort some 6 years ago.
Might as well just take a dump of the card, or several hundred thousand, and keep em on a thumb drive. Keep all the data, and replicate later at your leisure. (Same AC as before...I really need to register already.)
Seems to me a blank magstripe card is a whole lot more suspicious than a room key card.
If libertarians are so opposed to effective government, why don't they all move to Somalia?
Comment removed based on user account deletion
On television they showed how waitresses, clerks, and other staff snake-in a machine (looks like a cellphone) and swipe the card directly through it. They can compile about 100 numbers per day and then produce fake cards in their home basement. ----- I was a victim of this. I stayed in a Motel 6. About two months later some guy in California spent $3500. Seems obvious the girl behind the desk swiped the number off my card.
>>>Wait...which industry? The hotel industry?
"Hotels lead the [credit] industry in credit card theft." There. Fixed that for you. - Are you happy now? Here let the gorgeous Michelle Branch sing you the song: http://www.youtube.com/watch?v=d1vjRu3WUEE#t=14s
"I disapprove of what you say, but I will defend to the death your right to say it." - historian Evelyn Beatrice Hall
That said, I did read once that police were puzzled at one point when some people arrested were carrying large numbers of assorted gift cards for various retailers. It turns out that not only are they useful for laundering money, but many were over-written with stolen CC data.
I'm reading this story while sitting in limbo waiting for a replacement card to arrive, because my CC issuer recently called to say that my card had been flagged as "vulnerable". Of course the guy I'm talking claims (and I believe him) to have no information about what exactly led them to believe that my card is as vulnerable as they think it is.
So that got me thinking: wouldn't it be nice if I could know which vendor was responsible for the security breach? I'd definitely make it a point not to go back there, at least unless and until they demonstrated to me that they'd taken appropriate measures to reduce the likelihood of another breach happening. I've had probably half a dozen such reports from my cc company over the past five years. I always wondered what was up, because I kind of make a point of not using my card in a place that looks shady. But I do stay in a lot of hotels. So thanks to the originator of this story for helping me make sense of my experience.
I'm sure there would be lots of problems with forcing cc issuers to disclose the name of the vendor when cancelling a card for security reasons. But i'd still like to have that information to guide my future choice of vendors! It would also apply some market pressure to have hotels, or whoever else, get their security acts together.
We'll be working on a build of our opensource POS designed for hospitality starting in October and ready for release early next year. We've gone through the PA-DSS audit process and frankly, with todays payment systems, if your POS system is storing any card holder data, you're doing it wrong. We off load that data to the CC processor and only store either a transaction ID that can referenced later or a token of that card, not the card data itself.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
The only time my credit card was robbed was by a hotel, in Paris. The FBI ignored me, the French police ignored me, my credit card company ignored me after they canceled the charge (without evidence). It's a "cost of doing business" to them, but my hours of time, long distance phone bills, and inconvenience are a cost to me. And to the next person that hotel robs, or the hotel down the street.
It's obvious that credit cards should have one-time passwords for distribution. One password per transaction, assigned to a specific amount of money. The card's chip can keep a cache of them, to be read by merchant's machines or the owner's pocket display or USB.
Why do I even have to give my card to some waiter while they run it through their machine? They should bring me a wireless terminal and get my one time password for the bill amount.
And why can't I have a USB reader for submitting my one time password and billing info to a Web page, instead of having to retype it every time? How about connecting to my phone, so all I have to do to pay any bill is give a phone#, then say "OK" when the invoice message comes through, which sends back the one time password for that amount to that recipient?
$TRILLIONS flow through these cards. As they have for decades, including two decades on the Web and a decade while we've carried smartphones. Why isn't this simple and basically foolproof yet?
--
make install -not war
This is not surprising at all.
Nowadays CC info has to be stored in case of a no-show without cancellation or if the room is trashed.
Hotels have to store credit card info also for a very long time because bookings can be done like months in advance. Online booking agents take a 10% deposit and passes on the CC info to hotels, after that it can even be printed on paper and filed somewhere else than in a safe. That info is hardly ever destroyed in real-time, perhaps once in a year. CC-info can be sent unencrypted via email. Both clients and management may not be aware of any problems existing...
In general, most of the businesses operating in the industry are run by seriously low-tech people and here's the results.
One of the employees was pocketing the cash and charging the credit cards. We were later begged to stay, free of charge, the next summer. My parents ignored the request and we spent the next few years in a far less cozy location on the other side of the island.