Hacker News Reader

(Disclaimer again: I work for Booking.com in IT)

    > I would advice against agoda and booking.com as they
    > forward your credit card info to the hotel as security.

They don't forward your credit card as security. They forward it for the hotel to charge you for the entirety of your booking.

Companies like Expedia follow the merchant model, they buy up hotels rooms in bulk in advance and then re-sell them directly to customers. When you buy from a merchant your credit card isn't shared with the hotel as there's no need to do so.

Other companies like Booking.com and Agoda follow the agency model. They find customers for the hotels, forward their payment details along to the hotel, the hotel charges the customer, and then pays the agency a percentage of the booking as an agency fee[1].

Both models have their pros and cons. The merchant model works brilliantly in the US where large chains are the norm. It works less well in Europe where the vast number of hotels are small properties.

    > Imagine the surprise when you are at the hotel counter
    > and the staff shows you a printout of your credit card
    > info(nothing obscured; everything in plain text).

It's fair enough that this makes you uncomfortable. But the hotel with that printout has a contract with the credit card company like any other merchant and is responsible for treating it responsibly.

I think you'd also be very surprised at the number of other merchants you might deal with where this is the case. Having a printout with a credit card number is not at all unusual in a lot of businesses.

Not unusual doesn't make it acceptable. It is still a PCI DSS violation.

Sending them over is not. It's allowed under the PCI standards to send credit card numbers unencrypted via the fax system. I believe it's then up to the receiver of the fax to physically secure it. But I'm not overly familiar with these standards.

> I believe it's then up to the receiver of the fax to physically secure it.

Yes, I get it. Once you fax it to the hotel, it's not your problem. But how does it make things any better for me? You are still PCI compliant, but the customer now has his info passed to a random hotel clerk.

I think you might be making the implicit assumption that this is somehow shady or out of the ordinary when it comes to credit cards.

When you hand your credit card over to any clerk anywhere you're giving them access to your name and credit card number. If you hadn't booked through an OTA your credit card number would have likely been manually written down anyway on a piece of paper by the clerk at the desk.

All of this is PCI compliant, in order to process payments at all the hotel has a contract with the credit card company (or a local bank by proxy) which stipulates that they have to adhere to the relevant PCI standards.

Could this be more secure? Of course it could. But credit cards were never meant to be secure. They explicitly take convenience and the ability to do offline payments (writing down your credit card number for later) over security. If anything goes wrong they'll use some of the money they get from transaction fees to refund fraudulent payments.

> They don't forward your credit card as security. They forward it for the hotel to charge you for the entirety of your booking.

Security, as in, the hotel will charge me with the passed-on information if I don't turn up. I still have to swipe my card if I turn up.

I don't like increasing the number of variables. When I pay directly to booking.com, I am dealing with a PCI compliant company. When you pass my credit card info to a hotel clerk, I am dealing with a hotel clerk who has my info who is free to pass it to his friends, or dump it in a trash can(knowingly or unknowingly) from where someone else picks it up.

This is because of momentum. The online travel websites have established themselves among a portion of the population. As a result, in competitive regions, hotels have to play the third party travel website game, which means offering their rooms cheaper there, otherwise their competitors will get that business if they choose not to offer it. However, as I noted below, if you call directly, and offer to pay the hotel directly 5% less than what Expedia or whoever is offering you a room, they should take the money, unless they are incompetent. I would ask to speak to a manager if the lowly desk clerk doesn't accomodate.

The larger hotel franchises are combating this with www.roomkey.com, which is a direct link to the hotel.

As for credit cards, all major hotels (Choice/IHG/Wyndham/Hilton/Accor) have systems that comply with credit card standards. Credit card numbers should not, and I have never seen them, printed plainly on any piece of paper. They are not even visible to most employees, only managers, if proper procedures are followed. They are forwarded to hotels as a security deposit because sometimes the third party websites are not paying, the guest is, and the hotel then pays the travel agent. In this case, the hotel needs the guest's card info to authorize the card after the cancellation period has expired, so that the hotel has a guarantee of being able to collect the money.

>I tried, and the link is down. Most of the hotels don't even have websites, let alone online reservations. There is a reason customers go to expedia in the first place.

In America, most hotels certainly do have websites, via their franchise. If they don't, I'd advise looking up their phone number (google, tripadvisor), and calling them.

Online travel didn't establish themselves, it was failure of the hotel industry to do competitive online booking. It still is a failure, i get better prices through hotels.com. Also if I book through the hotel directly, some hotels tack on $20 to $30 resort "fees", they'll match hotel.com and when you get there, you get nailed with bogus fees. There is absolutely no reason to book through a hotel directly.

> if proper procedures are followed.

I have seen the proper procedure violated. I don't think hotels need to comply with PCI, so that safety net isn't there. I am a bit paranoid and I can't just count on people being good and competent.

> In this case, the hotel needs the guest's card info to authorize the card after the cancellation period has expired, so that the hotel has a guarantee of being able to collect the money.

Won't work with me. I do all online payments with a virtual credit card. The virtual credit card is linked with my actual credit card and I can reset the limit of the card as often as I like. If I am buying a hotel room which lists itself as X per night and I am buying it for 2 nights, I reset my limit to 2*X and make the booking. If you try to slap extra charges on me, the transaction will be denied.

In a similar vein, if I don't turn up, I will simply reset my limit to 0. The hotel won't be able to charge me.

> I tried and the link is down.

lunabluehotel.com seems to have gone offline yesterday, I suspect as a result of a traffic spike following their blog post. From their twitter stream:

> Seems that our website, http://www.lunabluehotel.com is currently down. We have a call in to find out why & solve the... http://fb.me/15notFYoE

(Note the link at the end of the tweet is also broken.) They also posted on the 23rd that views of their wordpress-hosted blog post were spiking:

> We just noticed that views of our Expedia blog post have gone through the roof for the 24 hours or so, all coming... http://fb.me/zyw2aX7R

I concur!

When you book via Agoda.com you get points that can be used toward future bookings. It’s effectively a 4% rebate, so even if the hotel can match the Agoda price, it’s still a better deal to book it via Agoda, that said, in the past I would often ask the hotel, before booking, if they could match the Agoda price, and more often than not, the answer was no.

Despite my best efforts, I did not succeed in getting an explanation of this policy.

In the case of Agoda, they do not buy the rooms in advance.

Did you ask to speak with a manager or someone in sales? Most desk clerks are minimum wage employees who won't go out of their way to make a sale, but any competent manager would never forgo cutting out a middleman.

I'm not sure this is what people usually mean when they say "cutting out the middle man." Here the hotel and you are actually using the services of a middleman without then paying.

A few times I was given the phone number / business card of someone who may have been able to provide me with a better discount than what the checkin staff was authorized to offer.

I never bothered following up on that though, as it seemed more hassle than just booking via Agoda.

> I would advice against agoda and booking.com as they forward your credit card info to the hotel as security.

I always pay agoda with paypal when I travel in SE Asia, and now more than ever i'm glad for it ...