Hotel keeping debit card details

[Heratnumber7]

We’re just back from a weekend away, and I’d like to gauge opinion on something before I write to the hotel management to complain.

We booked online, via booking.com I think (DH booked it).
When we checked into the hotel we were asked for our debit card so hotel could take a copy to use in the case we caused any damage in our room. We refused, but had to comply in the end because we couldn’t provide £50 cash deposit instead, and it was late so we were unlikely to find somewhere else (and we’d paid anyway).

Hotel assured us that copy of card would be locked in safe, and shredded after we’d left by “housekeeping”.

We said that wasn’t acceptable, and demanded the copy be returned to us when we left.

When we left and got the paper copy back we noticed that the hotel had also taken a note of our 3 digit security number on the same piece of paper AND they’d scanned our signatures from another form we’d signed for them to compare signatures to if we ordered at the bar, and pasted them alongside our card details.

I also now think that the whole piece of paper containing our details which was returned to us was a photocopy, which means hotel may still have a copy.

We’re very uncomfortable about the whole thing - we are vulnerable to fraud, and the two hotel employees who have access to the safe are also in a vulnerable position as customers could easily claim the card has been used to make purchases without their permission.

Has hotel broken the law? And should I complain? And if so, to whom?

[ChickenlessHead]

Don’t all hotels do that? I’ve always had to give a card, they take the details from it, then you can use it for room service.

[ChickenlessHead]

Although thinking about it they’ve always asked me for a credit card and not accepted debits.

[Caulk]

When they gave you the paper back with all the information on, what did you say to the staff? Did you complain then?

[cardibach]

Yes, very normal to take card details - not for damage but for anything you want to charge to the room. Usually a credit card I think.

[Rhynswynd]

It is fairly normal practice but if you are worried just ask your bank for a new card.

[Justmuddlingalong]

Most of the hotels I've ever stayed at do this.

[troodiedoo]

Was it a low rent hotel? Pre authorisation is standard but usually by chip and pin or swiping. Never heard of paper copy.

[FiveGoMadInDorset]

It is legal but they also have a legal requirement to keep all your details safe

[OldWitch00]

Always a credit card, never thought of or would consider a debt card...

[MissConductUS]

In the US every organization that touches payment card data has to comply with these standards:

www.pcicomplianceguide.org/faq/

They do not have the force of law, but non-compliance can result in no longer being allowed to take payments electronically. Things may work under a whole different regulatory system where you are, but I'd start by asking the bank or other financial institution who issued the card if the hotel was in violation of anything.

[Pseudousername]

No they can't just copy down all of your card details - what if they lose it or someone breaks in and steals it?

Cancel and get replacement cards and yes complain to the hotel.

Any "stored" card details MUST be properly encrypted and not just written down in plain site.

Presumably your full name and home address were also on that sheet of paper?! Hello ID theft.

[Sayyouwill]

I’m a hotel manager.
We need card details. Our system (opera) blocks out the details so it appears:
XXXX XXXX XXXX 1234
We need the expiry date to preauthorise a card against a room. This is needed because the sheer amount of damage that we have to deal with is ridiculous. I have had guests who have literally smeared shit on the bed and walls. If we don’t take details then we are not protected against those who do try and take advantage of the fact that they’re not at home.
All paperwork that contains any sensitive information is secured and disposed of into a document box which is locked and removed by external companies.
Hotel staff have to sit through lots and lots of videos and training regarding protecting sensitive information. It’s not worth the staff members job to retain information for their own gain. Not only would they be sacked but also prosecuted.

Many hotels (I’ve worked in 4) have a very similar operating system and standards of practice. Speak to them if you’re feeling uncomfortable with what happened and they’ll be able to explain their policies to you.

[MrsPicklesonSmythe]

It's standard practice.

[Sayyouwill]

Also, card details allow you to ‘post’ to your room, as in charge room service/drinks at bar etc to your room and you receive a bill at the end

[MaidOfStars]

Standard practice to preauthorise for damage/minibar/hotel facilities and to take card details and electronic signature for this purpose.

I have only ever had an electronic swipe taken though, and assumed (incorrectly?) that the exact details were encrypted on the computer something something.

I would be very perturbed to see a paper photocopy of my card, plus my CVC jotted alongside.

[Heratnumber7]

What pseud said.

Hotels usually swipe your card, and put through a dummy transaction, or take some money and reverse the debit later, so no one has your card details.

I think hotel is compromising all data protection guidelines, and fear for staff who are very vulnerable to accusations of fraud, as well Us to actual fraud.

I work in a HQ of a bank, and we’re given regular training on data protection, and this doesn’t sit easy with me.

We have cancelled our cards. It’s a small hotel group (4), and is “company policy” apparently - I think I’ll email and complain, for the staff’s sake as much as ours.

I also didn’t like that the room key fob had the name of the hotel and our room number on it. Will mention that too.

It was a slightly old fashioned hotel.

[Heratnumber7]

I can’t see what difference it makes whether it was a debit or credit card. Same DP stuff.

[BritInUS1]

YABU this is normal practice. I can't believe that you have cancelled your cards

[CotswoldStrife]

Standard practice, we've stayed in places that have pre-authorised amounts as well that take a while to come back!

They have always been swiped though - did you ask them not to swipe it but copy the details instead?

[NorthCoast]

It's been a while since I've worked in this area, but it used to be that you were not allowed to store the 3-digit CVC in any form, which would include writing it down, so that's a potential compliance breach.

[treaclesoda]

I've always had my card swiped but I've never had anyone take a photocopy of it. Or not that I am aware of anyway.

[Sayyouwill]

@NorthCoast you are correct. We’re not allowed to ask for them over the phone.
This makes me think that the staff member was new and as you would usually give the 3 digit security number when a card was being processed over the phone with places like ‘just eat’, so maybe they were worried and took down too many details.

Regardless the paperwork will be shredded.

[Jayne35]

I work in a hotel, taking card details to enter on the system (then encrypted) is normal practice, for additional charges, no shows etc. They should not have written down the security code though. With regard to the hotel name, room number on the key you would be surprised at the amount of people forgetting their room number and of course it would have the hotel on, especially an older hotel without electronic locks. So by all means complain to the hotel management, but only about the code being written down.

[FluttershysCutieMark]

Really?! You don't like that the key has the hotel name and room number? Now your just looking for problems to complain about OP.

[ticketytock1]

Yabu
If you work for a bank you will also know that you are protected against fraud in your account