| Welcome to my urban myths and urban legends articles. I regularly receive these from friends, and I enjoy tracking them down and debunking them. This series of articles will help you learn about urban myths and how to spot them in the well meaning articles you receive on email. Soon you'll be able to debunk your friend's gullibility too! |
Hotel Key Cards and Credit Card InformationI enjoy when people send me fantastic sounding stories like the following: | Subject: ID THEFT ATTACHMENT Southern California law enforcement professionals assigned to detect new threats to personal security issues, recently discovered what type of information is embedded in the credit card type hotel room keys used through-out the industry. Although room keys differ from hotel to hotel, a key obtained from the "Double Tree" chain that was being used for a regional Identity Theft Presentation was found to contain the following the information: - Customers (your) name
- Customers partial home address
- Hotel room number
- Check in date and check out date
- Customers (your) credit card number and expiration date!
When you turn them in to the front desk your personal information is there for any employee to access by simply scanning the card in the hotel scanner. An employee can take a hand full of cards home and using a scanning device, access the information onto a laptop computer and go shopping at your expense.Simply put, hotels do not erase these cards until an employee issues the card to the next hotel guest. It is usually kept in a drawer at the front desk with YOUR INFORMATION ON IT!!!! The bottom line is, keep the cards or destroy them! NEVER leave them behind and NEVER turn them in to the front desk when you check out of a room. They will not charge you for the card. Detective Sergeant K. Jorge, Pasadena Police Department |
My instincts said this sounded like a hoax. So off I went to Google to check it out. I tried the following search on Google: "hotel key cards" "credit card" And here is what I found: | Received on 10/23/03 in response to queries at City of Pasadena Website: The following information is in response to numerous inquiries about an e-mail that was distributed regarding hotel card keys and personal information. Please take note and feel free to share with any constituents who may also have concerns. On October 6, 2003, Detective Sergeant Kathryn Jorge of the Pasadena Police Department received information from a group of Southern California fraud detectives who had formed a fraud investigations network through a local internet carrier. One of the members of this group from another San Gabriel Valley agency reported that in an investigation that he was personally involved in, he came across a plastic hotel card key from a major hotel that had personal information that could potentially lead to identify theft and fraud. This information included names, addresses, length of stay, and credit card numbers. This detective took the precautionary measure of notifying the detectives in the network prior to seeing if this practice was standard in the industry. As the investigation into this potential fraud risk continued, this information was shared with other members of the Pasadena Police Department and personnel chose to share this information with others before we could correctly evaluate the risk. This has caused a chain reaction of probably thousands of people being given this information before the risk was evaluated thoroughly. As of today, detectives have contacted several large hotels and computer companies using plastic card key technology and they assure us that personal information, especially credit card information, is not included on their key cards. The one incident referred to appears to be several years old, and with today's newer technology, it would appear that no hotels engage in the practice of storing personal information on key cards. Please share this information with anyone who has a concern over the initial information send out to others as a precautionary measure. There was never the intent of the Pasadena Police Department to forward this information to others before the risk was evaluated. The information was forwarded by individuals as a possible precautionary note of interest only. Janet A. Pope Adjutant to the Chief of Police/Public Information Official Pasadena Police Department 626.744.4537 |
So my instinct was right. The reality is that a keycard would need to store little more information than a "record locator", or "index field", ID that uniquely identifies your record in the hotel's master database of thousands of reservations. These master databases are guarded from changes, and can only be changed at select terminals with access by select employees who have to log in to update your personal details. These changes are easily tracked by the system. When you use your card at some device, all it has to do is read your key code, and then access the master database in a read-only fashion to verify your access. In fact, the system is probably even double blind, in that the card doesn't even carry your master record number, it merely carries it's own ID number, and this ID number is cross referenced to your record number within the master database. Of course access to this table is guarded, and it can not be changed on a whim. It's very easy for the hotel to delete the cross reference linking your card to you if the card should get lost or stolen. Then the card would be linked to no one. The card, or devices using the card, might never know your "Record locator" or any other personal information about you. The other tipoff to me is that since such a system of cross references is trival to implement if all card reading devices are somehow linked to the central database, (and such linking can be done easily over wireless encrypted links, or simple wired networks running through the walls), the hotel would be daft to allow an item that they trust such as a card to be out in the public where they have no control over it. What if someone signed in with a real credit card, the credit card number got written to the card, then later the person rewrote the card with other info like a fake credit card number, and then ran around the hotel using the trusted card with this fake number. That wouldn't make any sense at all. Case closed. | |
