Hotel / Motel Key Cards Encoded with Personal Information

Netlore Archive: Email rumor claims hotel and motel key cards are routinely encoded with customers' personal information, resulting in identity theft by employees

Description: Email rumor
Circulating since: Oct 2003
Status: False

Email example contributed by Eric, Oct. 14, 2003:

Comments: "That's just a nasty rumor," says Kathy Shepard, vice president in charge of corporate communications for Hilton Hotels Corporation, which owns and operates the Doubletree Hotel chain. "Our key cards are encrypted with minimal information -- the guest's name, room number and arrival and departure dates -- and encrypted in such a way that they can't be read by ordinary card readers."

According to Shepard, whom I interviewed on October 20, 2003, the rumor stemmed from an actual incident in 1999 in which a southern California police officer claimed that personal information had been easily extracted from a key card procured at a franchisee-owned Doubletree hotel. In later attempts officers were unable to reproduce that result, however, and the original claim has since been retracted, Shepard says.

Detective Sergeant Kathryn Jorge of Pasadena, who authored the above email alert, offers a slightly different version of events but agrees on the essential detail that the key card systems currently used by Doubletree and other major hotel chains pose no such security threat to guests.

"In years past," she said in a statement quoted by the news Website Bend.com, "existing software would prompt the user (employee) for information input. If the employee was unaware of hotel policy dictating that such information NOT be entered, it could have ended up on the card in error. Since this subject came up, experiments on newer cards have failed to duplicate the problem. It appears that the problem is not as widespread as it used to be in the larger chain hotels."

That said, it's worth noting that law enforcement officials still warn that lost or stolen hotel keys can be put to ill use by identity thieves in another way - namely, re-encoding them with stolen personal information and using them to mimic ATM or credit cards for unauthorized purchases and withdrawals. Prudence therefore dictates returning key cards to the hotel registration desk upon checking out or destroying them to prevent their falling into the wrong hands.

Update: Official statement from the City of Pasadena.

Sources and further reading:

Hotel Cards: Holding ID Key?
LA Times, 7 May 2006

It's Just the Key to Your Room
Computerworld, 16 January 2006

The Embattled Swipe-Card Hotel Key
NY Times, 8 November 2005

Debunking the Key Card Myth
USA Today, 5 November 2003

Last updated: 01/16/06

Current Hoaxes / Netlore
The Urban Legends Top 25