6 ms·

Did you know that booking.com stores your credit card information and sends it, in plain text to the hotels - allowing them to charge you? [1] [1] https://part

• czbond 3y ago
  The Phuck - who is that allowed?!!! <after review> Ah - there are some quirks allowed by PCI from device to device (E2E) with TLS.
• jacquesm 3y ago
  That's not Booking.com's fault though. Many hotels are hopelessly behind the times and they don't have the capability to process the charges any other way and so there is quite a bit of pressure on booking.com to keep this functionality alive. This is a problem all over the hospitality industry. At least PCI/DSS compliance ensures that there is some minimum level of security involved and ultimately the merchant that is the recipient of that information is on the hook for all of the charges they make if you should dispute them. Credit cards have more consumer protection built in than most other forms of payment. If they wouldn't send the card information 'in plain text' it would be useless to the hotel. And every time you visit a hotel and hand them your card they tend to make an imprint of the card, the only thing the hotel doesn't have is the CVC and in the normal flow this isn't exposed, only when you escalate to some level of exception (and I'm not sure what the criteria are for that).
  • jabroni_salad 3y ago
    Kinda is their fault... the recipient might be the dictator but the sender can choose not to play or can display a checkbox to consumers authorizing an unsafe transmission so they can make an informed decision. Instead they just do it and you assume the store is secure because isn't store security mostly a solved problem at this point? Those of us who transact directly with the hotel instead of booking agents stay winning I guess.
    • vkou 3y ago
      If the sender doesn't play ball, they won't have any business. Third-party aggregators and hotels are a complete shit-show. But as long as I can save $30 on my trip, I will keep using them...
      • jabroni_salad 3y ago
        I am not a marketing professional but what about something like this. "Our booking service is xxx MM consumer's first choice for planning trips. Get access to our customer base and reduce administrative workload by adding our integration to your point of sale system. 4 competitors within 5 miles of you are already booking with us!"
      • xur17 3y ago
        Especially since I have zero fraud liability as a customer. No real incentive for me to care. The real solution is for the credit card companies to lay down requirements for these merchants (no storing in plain text).
        • jacquesm 3y ago
          They already do so. The card data is not stored 'in plain text', but encrypted at rest. But for the Hotels there are interfaces that allow these to be exposed to the Hotel employees (accesses of such information are logged). Just prior to displaying them they are decrypted.
          • callalex 3y ago
            You have your facts wrong. https://arstechnica.com/information-technology/2023/02/mysterious-leak-of-booking-com-reservation-data-is-being-used-to-scam-customers/?comments=1&post=41615090 https://arstechnica.com/information-technology/2023/02/myste...
            • jacquesm 3y ago
              Would it pain you to spell out which of the facts are wrong?
  • deanc 3y ago
    It's 2023 and my credit card is left wide open to fraud and booking.com facilitates this. I presume when you choose "pay at the hotel" and have to enter your full details including CVC, this is in order for the hotel to charge you in the case you decide to not pay. But in that case booking.com should handle the dispute, as opposed to introducing another compromise vector for any attacker. I've literally seen my details printed on paper at a small hotel in Tyrol. God knows what security they are running at the front-desks at these places.
    • jacquesm 3y ago
      That flaw is inherent in credit cards and you as the user have a dispute process at your disposal for charges that you don't want to be on the hook for. The CVC is just slightly less problematic than the rest of the card data. And that small hotel in Tyrol is probably ok, but I had my card cloned within minutes of eating at a restaurant in Toronto. The whole concept of a bunch of numbers that allow for arbitrary charges against you is flawed. Booking.com doesn't facilitate fraud any more than your credit card company does, and so far I've been able to successfully dispute every charge that I did not agree with on my card. The day that changes I'll stop using them entirely.
  • hiatus 3y ago
    PCI DSS requirement 4.2 explicitly forbids sending credit card data via email. https://pcidssguide.com/pci-compliance-and-email-security/ https://pcidssguide.com/pci-compliance-and-email-security/
    • smueller1234 3y ago
      And even though I've not worked there in many years, I can tell you with extreme certainty that booking doesn't do that. They're also (hopefully obviously!) PCI compliant.
    • jacquesm 3y ago
      And they do not. What they do do is offer a portal where the hotel can look this information up and they very explicitly caution against photographing or doing other stuff to that number other than to enter it into their POS to perform some transaction.
  • lencastre 3y ago
    I’ve been to hotels in Brazil where they literally copy your CC information completely into a text box in the hotel’s check in system. After that experience once, never ever again…
  • rescbr 3y ago
    > And every time you visit a hotel and hand them your card they tend to make an imprint of the card I haven't had my card imprinted (or, later, photocopied) in hotels since a long time. Now it's just a pre-authorization. Although recently I had my credit card photocopied by a car rental agency so they would be able to phone the card processor and cancel the pre-auth manually. Absolute madness. > the only thing the hotel doesn't have is the CVC Considering the most recent credit cards that I have been issued, most lost the embossing and now print the PAN on the back together with the CVC, so if some hotel photocopies the card - as nobody have the imprinters anymore - the CVC is there. This also applies to the last embossed card that I have in my wallet, an Amex card, which always had the CVC on the front that wasn't captured with an imprinter. Now with photocopiers, it is.
    • jacquesm 3y ago
      I've still had it happen this year, but I visit weird places :)
    • davchana 3y ago
      why does it feels like I read this exact chain of thread few days ago? the only thing different is that chsin mentioned UK too.
• eli 3y ago
  "Plain text" over an encrypted connection you mean? How else could it work?
  • zinekeller 3y ago
    Probably meant sending the payment details without tokenization, which in practice means sending a merchant-specific (in case of this one, hotel-specific) card details (https://www.emvco.com/emv-technologies/payment-tokenisation/ https://www.emvco.com/emv-technologies/payment-tokenisation/). A lot of hotels, for some reason that I still don't know, are still relying on MOTO methods to process payments, and MOTO requires the whole card number/PAN, name on file, expiry, and CVV to be sent (which I encounter from-time-to-time because my non-MOTO Mastercard is being rejected for being too weird). Combine that with the fact that US cards don't really enforce 3DS means that you'll have a card number bonanza usable for most American stores.
    • PopAlongKid 3y ago
      What is MOTO? Nothing helpful from internet search or link in parent comment.
      • grzm 3y ago
        Likely Mail Order/Telephone Order https://blog.payjunction.com/moto-processing-definition https://blog.payjunction.com/moto-processing-definition
  • ben_w 3y ago
    A) 1. Booking request made, Booking.com holds card details 2. Hotel requests payment 3. Booking.com makes transaction from your card to hotel B) 1) Booking request made 2) Booking.com requires card details for immediate payment to them 3) Booking.com sends money from their account to hotel C) 1) Booking request made, Booking.com requires guest identity only 2) Hotel takes payment on arrival
    • ffgjgf1 3y ago
• seabass-labrax 3y ago
  Every time I've reserved a hotel room with Booking.com, the payment has required 3-D Secure verification. For me, this involves entering my VISA card's PIN into a card reader, thus needing both physical access to my card and knowledge of my PIN. That might not be very much consolation, but it's at least some protection against having your account fraudulently drained.
  • aeyes 3y ago
    Just last month I reserved on Booking.com, arrived at the hotel and to my surprise they said "we already charged you with the card you have on Booking". Charge came from Panama (the country) and the hotel isn't anywhere near. No physical card or further verification.
  • deleted 3y ago
    [deleted]
• hedora 3y ago
  Now I understand why hotels.com charges your credit card, then gives the hotel a different card number to charge.
  • lotsofpulp 3y ago
    Hotels.com (Expedia) also has an option to pay the hotel directly. They used to require paying Expedia, and then Expedia pays the hotel, and I am guessing it was to expedite receipt of commissions (since they receive cash immediately and pay hotel the same cash minus commission at a later date). However, I think the integrations and payment terms with the major hotel brands have gotten good enough that Expedia now prefers to be paid a commission by the hotel. This benefits Expedia as they are no longer wasting money dealing with chargebacks and card processing fees. FYI, typically, a hotel franchisee will pay 10% to 15% to the hotel brand franchisor (Hilton/marriott/etc), and if the guest uses a travel agent like Expedia or Booking or any of the corporate travel ones, another 15% or more to the travel agent, and then the 3% to the payment processors. So for a guest who reserved via travel agent at a franchised hotel, ~30% of the room rate right off the top will not make it to the hotel itself. And that is excluding the typical 10% to 20% sales tax the guest pays the government on top of the room rate!
    • Scoundreller 3y ago
      > Hotels.com (Expedia) also has an option to pay the hotel directly. They used to require paying Expedia, and then Expedia pays the hotel, and I am guessing it was to expedite receipt of commissions Depending on the jurisdiction, if credit card commissions are high and the vendor/hotel aren’t setup for bank transfers, this avoids paying 2x Amex/mastercard/visa commissions.
• vintagedave 3y ago
  At least (?) that's in an app. But it's worse. A hotel told me it's sometimes plaintext over email. https://arstechnica.com/information-technology/2023/02/mysterious-leak-of-booking-com-reservation-data-is-being-used-to-scam-customers/?comments=1&post=41615090 https://arstechnica.com/information-technology/2023/02/myste...
  • user3939382 3y ago
    That has to be a PCI violation. Maybe it doesn’t have any teeth. The CC networks seem lax with their rules.
  • Scoundreller 3y ago
    I wonder if the hotel uses an incoming-fax-to-email system.
    • smueller1234 3y ago
      Nice catch! That was indeed something we found about a decade ago when I worked there. I don't recall what the security folks tried to do about it. Generally, though, more and more hotels shifted from faxes to API integrations via channel managers. But that's a whole extra step in sophistication.
      • juliogreff 3y ago
        I worked on some of these systems as well. Credit card details haven't been sent by emails for many many years, and I believe the last fax Booking ever sent was somewhere in 2018 or 2019, the whole fax system was decommissioned. By the time I left I believe they were still showing CC details to hotels via the extranet or an app though. A virtual CC thingy exists, but like someone said upthread, hotels are very set in their ways and often behind the times.
        • smueller1234 3y ago
          Oh hilarious! The business logic for getting optimal routing for faxes was... quirky. Picking the right source country/line/carrier to get the best quality line while getting the lowest cost and balancing capacity. In the old days all held in a complex queue in a MySQL db (sigh). I recall getting paged out of bed a number of times as an escalation to get it all working again after we hit yet another lock contention issue in MySQL. Good times!
• lakpan 3y ago
  Are you 100% positive on that? Because last time that I saw that number in my family’s old hotel I remember it being “a virtual number” rather than the customer’s real card. https://partner.booking.com/en-us/help/policies-payments/payment-products/everything-you-need-know-about-virtual-credit-cards https://partner.booking.com/en-us/help/policies-payments/pay... The fact that it stores your card is pretty much an unescapable reality. Just like car rentals, they reserve the right to charge you before, during or after your stay, for the booking or for damages.
• tiberious726 3y ago
  If this counts as PCI compliance, I'm doing way too much work... How does this possibly count?
• Timshel 3y ago
  I always use virtual numbers. Too bad that those are not so popular and only few banks activate the service (I believe it's handled by Visa or Mastercard).
• deleted 3y ago
  [deleted]
• amelius 3y ago
  This sounds more like a problem with banks, to be honest. Why the hell don't banks get their shit in order? And why am I paying an X% commission for that crap?
• akira2501 3y ago
  Charge backs on "card not present" transactions are incredibly easy.