Hacker News Reader

Comment by deanc | Hacker News Reader

Did you know that booking.com stores your credit card information and sends it, in plain text to the hotels - allowing them to charge you? [1]

[1] https://partner.booking.com/en-us/help/policies-payments/gue...

View on HN

That's not Booking.com's fault though. Many hotels are hopelessly behind the times and they don't have the capability to process the charges any other way and so there is quite a bit of pressure on booking.com to keep this functionality alive. This is a problem all over the hospitality industry. At least PCI/DSS compliance ensures that there is some minimum level of security involved and ultimately the merchant that is the recipient of that information is on the hook for all of the charges they make if you should dispute them. Credit cards have more consumer protection built in than most other forms of payment.

If they wouldn't send the card information 'in plain text' it would be useless to the hotel. And every time you visit a hotel and hand them your card they tend to make an imprint of the card, the only thing the hotel doesn't have is the CVC and in the normal flow this isn't exposed, only when you escalate to some level of exception (and I'm not sure what the criteria are for that).

Kinda is their fault... the recipient might be the dictator but the sender can choose not to play or can display a checkbox to consumers authorizing an unsafe transmission so they can make an informed decision. Instead they just do it and you assume the store is secure because isn't store security mostly a solved problem at this point?

Those of us who transact directly with the hotel instead of booking agents stay winning I guess.

If the sender doesn't play ball, they won't have any business.

Third-party aggregators and hotels are a complete shit-show. But as long as I can save $30 on my trip, I will keep using them...

I am not a marketing professional but what about something like this. "Our booking service is xxx MM consumer's first choice for planning trips. Get access to our customer base and reduce administrative workload by adding our integration to your point of sale system. 4 competitors within 5 miles of you are already booking with us!"

Especially since I have zero fraud liability as a customer. No real incentive for me to care.

The real solution is for the credit card companies to lay down requirements for these merchants (no storing in plain text).

They already do so. The card data is not stored 'in plain text', but encrypted at rest. But for the Hotels there are interfaces that allow these to be exposed to the Hotel employees (accesses of such information are logged). Just prior to displaying them they are decrypted.

You have your facts wrong. https://arstechnica.com/information-technology/2023/02/myste...

Would it pain you to spell out which of the facts are wrong?

For the “encrypted at rest” statement I guess it depends on your definition of “at rest”. Email passes through many hands, and random mom-and-pop shops definitely aren’t using PGP. So any emailed credit card information is being stored on many different computers. In theory those kinda of logs should be purged regularly, but who knows.

Looks to me like you got your facts wrong. And your definitions too...

> And every time you visit a hotel and hand them your card they tend to make an imprint of the card

I haven't had my card imprinted (or, later, photocopied) in hotels since a long time. Now it's just a pre-authorization.

Although recently I had my credit card photocopied by a car rental agency so they would be able to phone the card processor and cancel the pre-auth manually. Absolute madness.

> the only thing the hotel doesn't have is the CVC

Considering the most recent credit cards that I have been issued, most lost the embossing and now print the PAN on the back together with the CVC, so if some hotel photocopies the card - as nobody have the imprinters anymore - the CVC is there. This also applies to the last embossed card that I have in my wallet, an Amex card, which always had the CVC on the front that wasn't captured with an imprinter. Now with photocopiers, it is.

I've still had it happen this year, but I visit weird places :)

why does it feels like I read this exact chain of thread few days ago? the only thing different is that chsin mentioned UK too.

PCI DSS requirement 4.2 explicitly forbids sending credit card data via email.

https://pcidssguide.com/pci-compliance-and-email-security/

And they do not. What they do do is offer a portal where the hotel can look this information up and they very explicitly caution against photographing or doing other stuff to that number other than to enter it into their POS to perform some transaction.

And even though I've not worked there in many years, I can tell you with extreme certainty that booking doesn't do that. They're also (hopefully obviously!) PCI compliant.

It's 2023 and my credit card is left wide open to fraud and booking.com facilitates this. I presume when you choose "pay at the hotel" and have to enter your full details including CVC, this is in order for the hotel to charge you in the case you decide to not pay. But in that case booking.com should handle the dispute, as opposed to introducing another compromise vector for any attacker. I've literally seen my details printed on paper at a small hotel in Tyrol. God knows what security they are running at the front-desks at these places.

That flaw is inherent in credit cards and you as the user have a dispute process at your disposal for charges that you don't want to be on the hook for.

The CVC is just slightly less problematic than the rest of the card data.

And that small hotel in Tyrol is probably ok, but I had my card cloned within minutes of eating at a restaurant in Toronto. The whole concept of a bunch of numbers that allow for arbitrary charges against you is flawed.

Booking.com doesn't facilitate fraud any more than your credit card company does, and so far I've been able to successfully dispute every charge that I did not agree with on my card. The day that changes I'll stop using them entirely.

I’ve been to hotels in Brazil where they literally copy your CC information completely into a text box in the hotel’s check in system. After that experience once, never ever again…

Are you 100% positive on that? Because last time that I saw that number in my family’s old hotel I remember it being “a virtual number” rather than the customer’s real card.

https://partner.booking.com/en-us/help/policies-payments/pay...

The fact that it stores your card is pretty much an unescapable reality. Just like car rentals, they reserve the right to charge you before, during or after your stay, for the booking or for damages.

At least (?) that's in an app. But it's worse. A hotel told me it's sometimes plaintext over email.

https://arstechnica.com/information-technology/2023/02/myste...

That has to be a PCI violation. Maybe it doesn’t have any teeth. The CC networks seem lax with their rules.

I wonder if the hotel uses an incoming-fax-to-email system.

Nice catch! That was indeed something we found about a decade ago when I worked there. I don't recall what the security folks tried to do about it.

Generally, though, more and more hotels shifted from faxes to API integrations via channel managers. But that's a whole extra step in sophistication.

I worked on some of these systems as well. Credit card details haven't been sent by emails for many many years, and I believe the last fax Booking ever sent was somewhere in 2018 or 2019, the whole fax system was decommissioned. By the time I left I believe they were still showing CC details to hotels via the extranet or an app though. A virtual CC thingy exists, but like someone said upthread, hotels are very set in their ways and often behind the times.

Oh hilarious! The business logic for getting optimal routing for faxes was... quirky. Picking the right source country/line/carrier to get the best quality line while getting the lowest cost and balancing capacity. In the old days all held in a complex queue in a MySQL db (sigh). I recall getting paged out of bed a number of times as an escalation to get it all working again after we hit yet another lock contention issue in MySQL.

Good times!

Now I understand why hotels.com charges your credit card, then gives the hotel a different card number to charge.

Hotels.com (Expedia) also has an option to pay the hotel directly. They used to require paying Expedia, and then Expedia pays the hotel, and I am guessing it was to expedite receipt of commissions (since they receive cash immediately and pay hotel the same cash minus commission at a later date).

However, I think the integrations and payment terms with the major hotel brands have gotten good enough that Expedia now prefers to be paid a commission by the hotel. This benefits Expedia as they are no longer wasting money dealing with chargebacks and card processing fees.

FYI, typically, a hotel franchisee will pay 10% to 15% to the hotel brand franchisor (Hilton/marriott/etc), and if the guest uses a travel agent like Expedia or Booking or any of the corporate travel ones, another 15% or more to the travel agent, and then the 3% to the payment processors. So for a guest who reserved via travel agent at a franchised hotel, ~30% of the room rate right off the top will not make it to the hotel itself.

And that is excluding the typical 10% to 20% sales tax the guest pays the government on top of the room rate!

> Hotels.com (Expedia) also has an option to pay the hotel directly. They used to require paying Expedia, and then Expedia pays the hotel, and I am guessing it was to expedite receipt of commissions

Depending on the jurisdiction, if credit card commissions are high and the vendor/hotel aren’t setup for bank transfers, this avoids paying 2x Amex/mastercard/visa commissions.

If this counts as PCI compliance, I'm doing way too much work... How does this possibly count?

Every time I've reserved a hotel room with Booking.com, the payment has required 3-D Secure verification. For me, this involves entering my VISA card's PIN into a card reader, thus needing both physical access to my card and knowledge of my PIN. That might not be very much consolation, but it's at least some protection against having your account fraudulently drained.

Just last month I reserved on Booking.com, arrived at the hotel and to my surprise they said "we already charged you with the card you have on Booking".

Charge came from Panama (the country) and the hotel isn't anywhere near.

No physical card or further verification.

This sounds more like a problem with banks, to be honest.

Why the hell don't banks get their shit in order? And why am I paying an X% commission for that crap?

I always use virtual numbers.

Too bad that those are not so popular and only few banks activate the service (I believe it's handled by Visa or Mastercard).

Charge backs on "card not present" transactions are incredibly easy.

"Plain text" over an encrypted connection you mean?

How else could it work?

Probably meant sending the payment details without tokenization, which in practice means sending a merchant-specific (in case of this one, hotel-specific) card details (https://www.emvco.com/emv-technologies/payment-tokenisation/). A lot of hotels, for some reason that I still don't know, are still relying on MOTO methods to process payments, and MOTO requires the whole card number/PAN, name on file, expiry, and CVV to be sent (which I encounter from-time-to-time because my non-MOTO Mastercard is being rejected for being too weird). Combine that with the fact that US cards don't really enforce 3DS means that you'll have a card number bonanza usable for most American stores.

What is MOTO? Nothing helpful from internet search or link in parent comment.

Likely Mail Order/Telephone Order

https://blog.payjunction.com/moto-processing-definition

1. Booking request made, Booking.com holds card details

2. Hotel requests payment

3. Booking.com makes transaction from your card to hotel

1) Booking request made

2) Booking.com requires card details for immediate payment to them

3) Booking.com sends money from their account to hotel

1) Booking request made, Booking.com requires guest identity only

2) Hotel takes payment on arrival

At least for me it usually works that way when I’m paying immediately/directly in booking.

The charge comes from Booking itself and I assume they ten transfer the money to the hotel/etc

The Phuck - who is that allowed?!!! <after review> Ah - there are some quirks allowed by PCI from device to device (E2E) with TLS.

Reply on news.ycombinator.com