5 ms·

> it is important to note that hotels inadvertently provided their Booking.com account login details to online scammers, there was no compromise of the code or

> it is important to note that hotels inadvertently provided their Booking.com account login details to online scammers, there was no compromise of the code or databases that power the Booking.com platform. Interesting precedent. The platform is responsible not just for their own security practices, but also their users' security practices.

another-dave 6y ago
On the other hand, if we consider the hotels as just a "user", why would they have access to full CC details, including security code. As someone booking a hotel on the site, I would expect booking.com to take responsibility for keeping my payment details secure (or, if they want to operate like a marketplace, make it clear that they're not taking responsibility, but in that case it looses a lot of value toe as an end user)
- avereveard 6y ago
  > why would they have access to full CC details, including security code. yeah I stopped using booking because of this. an hotel decided that the card used for reservation was the one to charge for my stay and charged it the day of arrival and I only discovered later when trying to reserve a rental car and I hit my card limit and couldn't. that pissed me off in so many ways, first because the booking wasn't a upfront pay but hotel did it anyway, second because booking disclosed my cc details to a third party instead of being a neutral escrow, and third of course because it bite me in the ass at the worst possible moment, as my car broke down and I needed to cover a rental and repairs while sorting out the rest of the travel.
  - jiofih 6y ago
    Sounds like you have a habit of not reading terms. For as much as I loath Booking, pay-on-arrival is clearly stated, and there is no escrow because you’re paying the hotel directly.
    - avereveard 6y ago
      terms say 'pay at the property', not on arrival, and it say the hotel 'reserves the right to temporarily hold an amount prior to arrival', not that it will charge the stay on your provided card.
      - jiofih 6y ago
        Straight from the checkout step where you enter a credit card: > The property will charge you: €xxx > The date you'll be charged—and what happens if you cancel—depends on the booking conditions. And then the booking conditions (set by the property): > You'll be charged a prepayment of the total price at any time.
        avereveard 6y ago
        your terms are wildly different from mine https://i.imgur.com/4qKVrBl.png https://i.imgur.com/4qKVrBl.png https://i.imgur.com/Ty7plol.png https://i.imgur.com/Ty7plol.png so maybe tone down the snarkiness and accept that services customs aren't as uniform as your anecdote made you assume them to be
        jiofih 6y ago
        The parts you highlighted refer to the online booking, and are correct - no charge to your card happened at the time of booking, you were charged by the hotel on arrival - as is custom on every hotel check in, online booking or not. On top of that, anyone taking a large payment via CC will usually require payment on the same card used for the authorization hold. Accepting another card is risky as funds can be easily made unavailable before the transaction settles. You just had wrong expectations - on cc charges, that booking would be a “neutral escrow” or be able/willing to help. I’ve been in a similar situation where they held the entire reservation amount, in the thousands, while having already taken payment, and it’s 100% up to the hotel. They just don’t give a shit. This is yet another reason why CCs are a terrible idea. Having the funds in a checking account and not being able to use them because of credit limit shenanigans is infuriating.
- em500 6y ago
  Traditionally Booking.com operated mostly as a marketplace ("agency" model, as opposed to "merchant" model like Expedia [1]). The contract and the payments are between the guest and the hotel, not between the guest and Booking. (Booking bills the hotel afterwards for the commission, they don't bill the guest for the stay.) Of course they don't always make this very clear to the consumer, and it seems to have gotten more muddled in the last few years. I think they're trying to nudge people more towards their own payment platform nowadays. [1] https://www.businessinsider.in/this-is-why-booking-coms-agency-model-has-an-edge-over-other-otas/articleshow/59102504.cms https://www.businessinsider.in/this-is-why-booking-coms-agen...
- nolok 6y ago
  Sadly it's not how these platform operates, they provide the card for security deposit usually. That's why I've used Agoda every time I could (works well in Asia, spotty elsewhere), because they allow paypal payment. Hotel will still want your card for the deposit but you can just provide it on the first day. This way you don't have to fight with a place that did overbooking or similar and still has your card on file.
tallanvor 6y ago
While the individuals themselves may be thought of as users, they are employees of 3rd party partners who act as data handlers and/or data processors. As such it is entirely appropriate that the platform is responsible for this compromise (although depending on the terms of the contract, they could seek restitution from the 3rd parties. If you as a consumer give your booking.com login information to someone and your information is subsequently stolen, Booking.com would not be responsible for your security practices.
merijnv 6y ago
> Interesting precedent. The platform is responsible not just for their own security practices, but also their users' security practices. Well, not really. Booking didn't get fined over security practices. They got fined over not notifying of a breach of their users data within 72 hours. So you're not really "responsible for users' security practices", you're "responsible for notifying users/authorities in time when you notice leaks/breaches". Seems rather different to me.
- CodesInChaos 6y ago
  This case is rather complex, because the customers have a contractual relationship both with booking.com and directly with the hotel. This makes it difficult to tell whose responsibility the breach notification is. I would have said that it's the responsibility of the individual hotels here.
- TheCoelacanth 6y ago
  Notifying users about a breach is a security practice, so they are being fined specifically because of their own security practices.
- dx034 6y ago
  Would Facebook have to inform me within 72 hours if someone got access to another account that can read private info of my account? I don't think that Facebook (or similar networks) disclose such breaches. At least I've never seen information on that.
xxs 6y ago
>but also their users' security practices. Of course, as the leak would be traced to them as well. When it comes to GDPR you'd like to manage the expose and the liability associated with having the data. Normally it should that even the admin operators are not to be trusted with full account/payment/etc. details enmasse and very special care is taken to exports/reports.

another-dave 6y ago

On the other hand, if we consider the hotels as just a "user", why would they have access to full CC details, including security code. As someone booking a hotel on the site, I would expect booking.com to take responsibility for keeping my payment details secure (or, if they want to operate like a marketplace, make it clear that they're not taking responsibility, but in that case it looses a lot of value toe as an end user)

avereveard 6y ago
> why would they have access to full CC details, including security code. yeah I stopped using booking because of this. an hotel decided that the card used for reservation was the one to charge for my stay and charged it the day of arrival and I only discovered later when trying to reserve a rental car and I hit my card limit and couldn't. that pissed me off in so many ways, first because the booking wasn't a upfront pay but hotel did it anyway, second because booking disclosed my cc details to a third party instead of being a neutral escrow, and third of course because it bite me in the ass at the worst possible moment, as my car broke down and I needed to cover a rental and repairs while sorting out the rest of the travel.
- jiofih 6y ago
  Sounds like you have a habit of not reading terms. For as much as I loath Booking, pay-on-arrival is clearly stated, and there is no escrow because you’re paying the hotel directly.
  - avereveard 6y ago
    terms say 'pay at the property', not on arrival, and it say the hotel 'reserves the right to temporarily hold an amount prior to arrival', not that it will charge the stay on your provided card.
    - jiofih 6y ago
      Straight from the checkout step where you enter a credit card: > The property will charge you: €xxx > The date you'll be charged—and what happens if you cancel—depends on the booking conditions. And then the booking conditions (set by the property): > You'll be charged a prepayment of the total price at any time.
      - avereveard 6y ago
        your terms are wildly different from mine https://i.imgur.com/4qKVrBl.png https://i.imgur.com/4qKVrBl.png https://i.imgur.com/Ty7plol.png https://i.imgur.com/Ty7plol.png so maybe tone down the snarkiness and accept that services customs aren't as uniform as your anecdote made you assume them to be
        jiofih 6y ago
        The parts you highlighted refer to the online booking, and are correct - no charge to your card happened at the time of booking, you were charged by the hotel on arrival - as is custom on every hotel check in, online booking or not. On top of that, anyone taking a large payment via CC will usually require payment on the same card used for the authorization hold. Accepting another card is risky as funds can be easily made unavailable before the transaction settles. You just had wrong expectations - on cc charges, that booking would be a “neutral escrow” or be able/willing to help. I’ve been in a similar situation where they held the entire reservation amount, in the thousands, while having already taken payment, and it’s 100% up to the hotel. They just don’t give a shit. This is yet another reason why CCs are a terrible idea. Having the funds in a checking account and not being able to use them because of credit limit shenanigans is infuriating.
em500 6y ago
Traditionally Booking.com operated mostly as a marketplace ("agency" model, as opposed to "merchant" model like Expedia [1]). The contract and the payments are between the guest and the hotel, not between the guest and Booking. (Booking bills the hotel afterwards for the commission, they don't bill the guest for the stay.) Of course they don't always make this very clear to the consumer, and it seems to have gotten more muddled in the last few years. I think they're trying to nudge people more towards their own payment platform nowadays. [1] https://www.businessinsider.in/this-is-why-booking-coms-agency-model-has-an-edge-over-other-otas/articleshow/59102504.cms https://www.businessinsider.in/this-is-why-booking-coms-agen...
nolok 6y ago
Sadly it's not how these platform operates, they provide the card for security deposit usually. That's why I've used Agoda every time I could (works well in Asia, spotty elsewhere), because they allow paypal payment. Hotel will still want your card for the deposit but you can just provide it on the first day. This way you don't have to fight with a place that did overbooking or similar and still has your card on file.

tallanvor 6y ago

While the individuals themselves may be thought of as users, they are employees of 3rd party partners who act as data handlers and/or data processors. As such it is entirely appropriate that the platform is responsible for this compromise (although depending on the terms of the contract, they could seek restitution from the 3rd parties. If you as a consumer give your booking.com login information to someone and your information is subsequently stolen, Booking.com would not be responsible for your security practices.

merijnv 6y ago

> Interesting precedent. The platform is responsible not just for their own security practices, but also their users' security practices. Well, not really. Booking didn't get fined over security practices. They got fined over not notifying of a breach of their users data within 72 hours. So you're not really "responsible for users' security practices", you're "responsible for notifying users/authorities in time when you notice leaks/breaches". Seems rather different to me.

CodesInChaos 6y ago
This case is rather complex, because the customers have a contractual relationship both with booking.com and directly with the hotel. This makes it difficult to tell whose responsibility the breach notification is. I would have said that it's the responsibility of the individual hotels here.
TheCoelacanth 6y ago
Notifying users about a breach is a security practice, so they are being fined specifically because of their own security practices.
dx034 6y ago
Would Facebook have to inform me within 72 hours if someone got access to another account that can read private info of my account? I don't think that Facebook (or similar networks) disclose such breaches. At least I've never seen information on that.

xxs 6y ago

>but also their users' security practices. Of course, as the leak would be traced to them as well. When it comes to GDPR you'd like to manage the expose and the liability associated with having the data. Normally it should that even the admin operators are not to be trusted with full account/payment/etc. details enmasse and very special care is taken to exports/reports.