5 ms·

(Disclaimer again: I work for Booking.com in IT) > I would advice against agoda and booking.com as they > forward your credit card info to the hotel as

by avar 14y ago

(Disclaimer again: I work for Booking.com in IT) > I would advice against agoda and booking.com as they > forward your credit card info to the hotel as security. They don't forward your credit card as security. They forward it for the hotel to charge you for the entirety of your booking. Companies like Expedia follow the merchant model, they buy up hotels rooms in bulk in advance and then re-sell them directly to customers. When you buy from a merchant your credit card isn't shared with the hotel as there's no need to do so. Other companies like Booking.com and Agoda follow the agency model. They find customers for the hotels, forward their payment details along to the hotel, the hotel charges the customer, and then pays the agency a percentage of the booking as an agency fee[1]. Both models have their pros and cons. The merchant model works brilliantly in the US where large chains are the norm. It works less well in Europe where the vast number of hotels are small properties. > Imagine the surprise when you are at the hotel counter > and the staff shows you a printout of your credit card > info(nothing obscured; everything in plain text). It's fair enough that this makes you uncomfortable. But the hotel with that printout has a contract with the credit card company like any other merchant and is responsible for treating it responsibly. I think you'd also be very surprised at the number of other merchants you might deal with where this is the case. Having a printout with a credit card number is not at all unusual in a lot of businesses.

lawnchair_larry 14y ago
Not unusual doesn't make it acceptable. It is still a PCI DSS violation.
- avar 14y ago
  Sending them over is not. It's allowed under the PCI standards to send credit card numbers unencrypted via the fax system. I believe it's then up to the receiver of the fax to physically secure it. But I'm not overly familiar with these standards.
  - irahul 14y ago
    > I believe it's then up to the receiver of the fax to physically secure it. Yes, I get it. Once you fax it to the hotel, it's not your problem. But how does it make things any better for me? You are still PCI compliant, but the customer now has his info passed to a random hotel clerk.
    - avar 14y ago
      I think you might be making the implicit assumption that this is somehow shady or out of the ordinary when it comes to credit cards. When you hand your credit card over to any clerk anywhere you're giving them access to your name and credit card number. If you hadn't booked through an OTA your credit card number would have likely been manually written down anyway on a piece of paper by the clerk at the desk. All of this is PCI compliant, in order to process payments at all the hotel has a contract with the credit card company (or a local bank by proxy) which stipulates that they have to adhere to the relevant PCI standards. Could this be more secure? Of course it could. But credit cards were never meant to be secure. They explicitly take convenience and the ability to do offline payments (writing down your credit card number for later) over security. If anything goes wrong they'll use some of the money they get from transaction fees to refund fraudulent payments.
irahul 14y ago
> They don't forward your credit card as security. They forward it for the hotel to charge you for the entirety of your booking. Security, as in, the hotel will charge me with the passed-on information if I don't turn up. I still have to swipe my card if I turn up. I don't like increasing the number of variables. When I pay directly to booking.com, I am dealing with a PCI compliant company. When you pass my credit card info to a hotel clerk, I am dealing with a hotel clerk who has my info who is free to pass it to his friends, or dump it in a trash can(knowingly or unknowingly) from where someone else picks it up.

by avar 14y ago

lawnchair_larry 14y ago

Not unusual doesn't make it acceptable. It is still a PCI DSS violation.

avar 14y ago
Sending them over is not. It's allowed under the PCI standards to send credit card numbers unencrypted via the fax system. I believe it's then up to the receiver of the fax to physically secure it. But I'm not overly familiar with these standards.
- irahul 14y ago
  > I believe it's then up to the receiver of the fax to physically secure it. Yes, I get it. Once you fax it to the hotel, it's not your problem. But how does it make things any better for me? You are still PCI compliant, but the customer now has his info passed to a random hotel clerk.
  - avar 14y ago
    I think you might be making the implicit assumption that this is somehow shady or out of the ordinary when it comes to credit cards. When you hand your credit card over to any clerk anywhere you're giving them access to your name and credit card number. If you hadn't booked through an OTA your credit card number would have likely been manually written down anyway on a piece of paper by the clerk at the desk. All of this is PCI compliant, in order to process payments at all the hotel has a contract with the credit card company (or a local bank by proxy) which stipulates that they have to adhere to the relevant PCI standards. Could this be more secure? Of course it could. But credit cards were never meant to be secure. They explicitly take convenience and the ability to do offline payments (writing down your credit card number for later) over security. If anything goes wrong they'll use some of the money they get from transaction fees to refund fraudulent payments.

irahul 14y ago

> They don't forward your credit card as security. They forward it for the hotel to charge you for the entirety of your booking. Security, as in, the hotel will charge me with the passed-on information if I don't turn up. I still have to swipe my card if I turn up. I don't like increasing the number of variables. When I pay directly to booking.com, I am dealing with a PCI compliant company. When you pass my credit card info to a hotel clerk, I am dealing with a hotel clerk who has my info who is free to pass it to his friends, or dump it in a trash can(knowingly or unknowingly) from where someone else picks it up.