4

From this post on Facebook, Agoda (and its sister site Booking.com) saved his credit card information and shared it with the hotel he had chosen.

enter image description here

My friend also shared the same experience when she stayed in Myanmar, when she wanted to extend the stay, the hotel's staff pulled the paper with all of her credit card information to charge her additional cost.

Is this practice common in booking services?

Second question (should this question be moved to Law SE?). From what I read in Information Security SE, those services aren't allowed to save this information (I will link to IS SE later). Can we do anything to prevent this practice?

  • 1
    Kind of shocking that they would do this! Also that the photo provided just propagated the issue unless the card was cancelled. – Itai Feb 5 '18 at 5:07
  • @Itai the card holder shared the information himself, I think he had it cancelled – Danh Feb 5 '18 at 5:10
  • 2
    By the way, credit cards company only require the use of a CVC code when the card is not present, so for online or phone transactions. For those, they also require the CVC code not to be stored after the transaction has been made. – Itai Feb 5 '18 at 5:12
  • From what I read on Information Security SE, they isn't allowed to save full number of credit card either, they can save at most 6 first and 4 last numbers. – Danh Feb 5 '18 at 5:14
  • 1
    @Moo if you store all the card details, PCI DSS also lists conditions on how you must store and distribute them. Having sheets of paper with all the data in plain text is not secure storage. If the merchant has a printout like this (or even the ability to make a printout like this) is an indication that it's violating PCI DSS requirements. – Peteris Feb 5 '18 at 9:51
1

Yes, almost every single hotel booking service will pass your credit card to the hotel as it lets them place a hold on your credit card in advance or charge it if you don't show up. Some services might be a bit smarter and let the hotel charge you without letting them see the actual card number, which would be more secure.

Overall I wouldn't worry about it. If you see a fraudulent charge simply block your card and ask the bank for a refund. You as a consumer carry zero risk as long as you notice the fraud on time.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.