6

I have booked lot of hotels on booking.com. I have their genius status. I have successfully used cards previously to book the hotel without providing CVV number. They never asked me this in my previous bookings. However, today when I was booking hotel, before confirmation, system was asking me to provide CVV number along with other cards details.

Initially, I used to think that booking.com handles pre-authorization payments (which I personally find more reliable than hotel directly accessing my card info). But then I saw few FAQs like this which suggests that hotels will have access to all of this information.

Is it safe to provide it? What if hotel misuses it?

| improve this question | |
  • 2
    The entire point of the CVV is to provide an additional level of security when making remote transactions, so I'm not exactly sure how a website asking for your CVV has somehow made you less secure. – choster May 6 '19 at 15:33
  • 2
    @choster it provides additional security to the site/merchant, and to a user only because their card cannot be used on a site which requires it if a fradulent user wants to use the card number without the CVV. However, if you provide a CVV and it is not properly protected, that means the information could be usable on other sites, which makes it less secure for the cardholder. Booking.com is clearly in breach of PCI DSS regulations: storing the CVV (which they have to do to show it to the property) is forbidden, but that's (sadly) a pretty common trend in the hotel industry. – jcaron May 6 '19 at 16:00
  • 3
    @jcaron But surely a rogue employee or hacker can do damage with a birthdate and a postal code? And any fraudulent use would be readily detected? Something as simple as entering your billing address potentially alerts someone that your home or business might be unoccupied on certain dates. Caution is always advisable, but if you can't trust transaction systems that the global economy relies on, then you can't really leave your house. – choster May 6 '19 at 17:19
  • 3
    The PCI standards, IIRC, forbid the storage of CVVs. If they're PCI compliant (and they should be) they'll be using the CVV to validate your card, but it will not be passed on to the hotel. (The hotel is unlikely to care about the CVV, as Booking.com has already used it successfully to validate, and they don't need it to charge you for a no-show.) – ceejayoz May 6 '19 at 21:17
  • 3
    @jcaron PCI DSS forbids the storage of CVV/CVC codes after the authorisation has been carried out, but its permissible to store the code in anticipation of authorisation - pcisecuritystandards.org/documents/PCI_DSS-QRG-v3_2_1.pdf . If Booking.com is handing off the authorisation to the hotel, they are doing nothing wrong by storing the CVV code. – Moo May 7 '19 at 1:07
6

It's as safe as providing the information to any e-commerce site and hotel. There is some risk of misuse, and you should be protected by the relevant laws and regulations in your country and the terms of your agreement with the bank governing credit card fraud. Booking.com is a very large and popular site, and plenty of people use it without incident.

If you're not comfortable with this, there are some alternatives you could consider:

  • Book with the hotel directly. This potentially reduces the number of entities with access to your card information. Many hotels (especially chains) will match or beat the pricing on sites like booking.com for direct bookings, since they'd rather not pay the commission to these sites. You can call the hotel if a comparable rate is not offered on their website.
  • Use a virtual credit card. Some banks have a feature to generate a temporary card number with a pre-set limit, to avoid exposing your real card. However, you'll likely have to give the hotel an actual credit card when you show up, so you'll need to be ok with that and ensure they're ok if you switch cards.
  • Use a credit card and not a debit card. There may be greater legal protections if there is fraudulent use, and your own money won't be missing while the fraud claim is investigated.
| improve this answer | |
  • Thank you for your answer. I did not get your last point. Why use Credit card? Isn't debit card more secure (as it will need our PIN for the transaction)? – Dexter May 7 '19 at 9:36
  • 1
    @Dexter A PIN is not used for online transactions on booking.com though, right? In at least some countries, the legal situation between a credit card and a debit card is different. With a credit card, it's the bank's money, so if there is fraud, you haven't lost any of your own money while the bank investigates your report. With a debit card, the money comes out of your bank account, and you may be without it while there's an investigation. But you'd have to look at how that works wherever you are. – Zach Lipton May 7 '19 at 10:02
  • This is not entirely true. With a „normal“ e-commerce or hotel website, the process is automatic and it stays entirely in their system. Often the site even uses a third-party processor and doesn’t have access to the Cc data at all. Booking.com stores the data and will sometimes show it to the hotel, as text on a web page. You cannot be sure when they do. In this case it all depends on the honesty of the person who has access to the hotel‘s booking.com account. – averell Mar 5 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.