How to Manage Hotel Payment Security

It’s been a long time since the only payment that hotels needed to secure was the cash handled by front-desk and service workers. Today, hotel guests have myriad platforms on which they can pay for a stay, service or on-property purchase. However, the expansion of hotel payment options — including use of mobile payments, touchless payment kiosks, online portals and gift cards— has also expanded hospitality organizations’ attack surface. To manage the risk of payment fraud and data theft while maintaining the availability and accessibility of payment systems hotels need a comprehensive strategy that includes what to do to prevent and detect threats against their payment processing systems.

What Is Hotel Payment Processing?

Hotel payment processing administers and tracks payments from guests. The goal is to establish platforms and procedures that efficiently and securely accept the payment methods guests want to use. Effective hotel payment processing requires a flexible payment collection infrastructure, seamless integration with third-party payment processors and banks, and the back-end financial systems that manage and track hotel financial statements. However, as the number — and complexity — of systems involved with payment processing increases, so do the potential vulnerabilities and entry points for cyberattackers. Hotels must take comprehensive measures to secure these systems and the connections between and among them.

What Is Hotel Payment Security?

Hotel payment security is the discipline of maintaining the integrity and confidentiality of all points within the payment ecosystem.

A layered approach to securing the payment process, from managing the security of the devices that accept payment methods to maintaining the confidentiality of payment data as it moves across internal and external networks, is critical. Layered security requires complex authorization and anti-fraud technology to ensure that customers are who they say they are and that they’re paying with their own funds or points accrued through loyalty and other programs. Thorough hotel payment security also manages the risk that privileged insiders or external attackers will subvert payment systems either to steal data or for monetary gain.

Key Takeaways

• The goal of hotel payment security is to ensure the integrity of payment authorization and minimize the risk of fraud.
• Protecting customer payment data and maintaining payment system availability are key to effective hotel payment security.
• As payment merchants, hotels must adhere to the security standards required of payment card brands through Payment Card Industry Data Security Standard (PCI DSS) compliance.
• Best practices in maintaining hotel payment security include data encryption and minimization, access control and authentication, and continuous monitoring of systems and payment activity.

Hotel Payment Security Explained

Hotel payment security aims to manage risk, with minimal friction, within the payment process. This involves measures that include:

• Ensuring the integrity of payment authorization and accounting recordkeeping
• Protecting customer payment data
• Preventing fraud and employee theft
• Maintaining compliance with government and industry regulations
• Confirming the uptime and availability of payment systems

Hotels must take a programmatic approach to securing payment processes and the digital infrastructure that supports them, establishing a documented plan and layering numerous integrated technology deployments to get it right.

Hospitality organizations should implement cybersecurity and anti-fraud controls designed to prevent attacks from ever happening in the first place at key points in the payment architecture. However, no security measure is bulletproof, especially when attackers are constantly evolving their methods and practices. For this reason, hotels also should implement incident response and detection mechanisms that will identify when a breach does happen and keep it from escalating into something damaging (or more damaging). In general, payment architectures and processes should be designed from the ground up, with a focus on resilience to attacks and visibility into payment activity.

Maintaining system availability should be a priority when designing and maintaining hotel payment security. This is particularly important as ransomware runs rampant across industries, with cybercriminals holding digital systems hostage by encrypting data or otherwise disrupting operations. The disruption to business caused by ransomware and other cyberattacks, such as distributed denial of service, can be extremely costly. For example, last year MGM Resorts reported that a massive breach it suffered not only resulted in stolen data but rendered its payment systems unusable. The incident cost the hotelier $100 million, a significant percentage of which was due to the inability of customers to book rooms. A month after the payment processing interruption, occupancy dropped to 88%, compared to 93% during the same period the year before.

With hotels and other organizations in the hospitality industry focused on maximizing their bookings, an incident like MGM’s can be devastating. But it’s important to note that hotel payment security isn’t just about technology. Comprehensive hotel payment security also requires measures that create a culture of security awareness among employees, partners and even customers. These include security awareness programs and education for employees and customers, as well as establishing security-minded partnerships with vendors and payment processors.

All of this comes at a cost, but the cost of not making the investment can be much higher. Hotels must make room in their budgets for investment in strong hotel payment security to protect their systems and their customers from cybercriminals and fraudsters.

Why Should Hotels Prioritize Payment Security?

Hotels and other organizations in the hospitality industry are prime targets for criminals focused on profiting through payment fraud, identity theft, ransomware and other criminal enterprises that target payment processing. Recent studies show that nearly one-third of hospitality organizations have reported a data breach at some point in their company history, and almost nine out of 10 have been affected more than once a year. When incidents do arise, they cost hotel brands an average of $3.4 million per incident. And, incidents that directly impact payment processing infrastructure often cost many times the average cost of a data breach, such as the MGM breach described above.

In fact, cyber threats like these are the top business risk faced by the hospitality and tourism industry — greater than risks incurred by business interruption, natural catastrophes or macroeconomic conditions. Hotels should invest in payment security not only to avoid the direct costs of breach but also to maintain their brand image within the highly competitive hospitality industry. According to recent studies, more than three out of five travelers say they are concerned about the privacy and security of the data they hand over to the hotels they do business with. When hotel brands can’t protect that data, consumers are bound to look elsewhere.

Biggest Security Threats to Hotel Payments

There are many threats to the security of hotel payment systems and the processes that depend on them, such as booking systems and loyalty programs. Here are some of the biggest threats hotels should keep in mind as they design their payment security systems, processes and educational efforts.

Data Breaches

About one out of three hotels has suffered a data breach, and payment systems are among the most attractive targets for criminals looking for sensitive customer data to sell on the black market, use for fraudulent schemes or leverage for extortion. The latter happened to hotel and casino operator Caesars Entertainment in 2023. Criminals targeted Caesars’s systems and stole the personal data of millions of the company’s customers. The criminals asked for, and received, $15 million from Caesars to keep the data from being released.

Credit Card Skimming

To steal credit card information, criminals install data skimmers and cameras on point-of-sale (POS) systems and other payment devices. The skimmers and cameras are used to steal the card data and PINs entered by customers. These devices are often well camouflaged and hard to detect, but employees can be trained to look for signs of tampering.

Phishing Scams

Phishing is a form of social engineering that attempts to trick people into revealing sensitive information or downloading malware that makes their devices vulnerable to a cyberattack. Phishing scams are typically perpetrated through impersonation. For example, a cybercriminal might send an email that impersonates a hotel chain brand and promises a free stay. The email might ask the recipient to respond by revealing personal information or clicking on a link. These scams fuel data breaches and the theft of sensitive customer information and can enable attackers to make fraudulent transactions on a payment system backend.

Insider Threats

In addition to threats from outside the organization, hotels must consider the threat posed by insiders, such as malicious or careless employees and contractors. Malicious employees with access to payment systems pose some of the biggest threats, albeit the least likely to strike systems. For example, an employee at a hotel in Missouri stole more than $150,000 over just eight months by manipulating hotel payment systems to show customers had used loyalty points to pay for their stays and to send the refund for the money charged to their cards over to her personal bank card instead. More common is the threat from employees who are merely careless about security — for example, by sharing credentials or leaving company devices unattended. Hotels can combat this with IT monitoring tools that track employee behavior to detect suspicious activity and with ongoing employee security-awareness training.

Point-of-Sale (POS) System Vulnerabilities

Software vulnerabilities and system design flaws in point-of-sale systems are common paths for exploitation by cybercriminals seeking to attack hotel payment systems. Attackers have developed a range of POS malware — from memory scrapers to keyloggers and network sniffers to RAM scrapers — designed to steal information and otherwise subvert the normal operation of POS terminals. Hotels can address vulnerabilities and protect against malware through the use of strong credentials, employee training, continuous monitoring of technology and effective network security.

Unsecured Wi-Fi Networks

Unsecured Wi-Fi networks make it easier for attackers to conduct man-in-the-middle attacks and other schemes that steal payment data as it is transmitted from customer to hotel and from hotel to payment processor. Inadequately or improperly secured Wi-Fi puts transaction data at risk of being plucked over the air by savvy attackers using automated network reconnaissance tools. This situation is worsened when stolen data is unencrypted.

Third-Party Vendor Risks

Hotels work closely with third parties to provide customers with everything from food services to online payment portals. To facilitate these relationships, hotels must grant third parties access to sensitive customer data and integration into payment systems. Even paper- or PDF-based processes like those still used in procurement could fall under this purview. Hotels must carefully, and continually, vet and monitor third-party security exposure as part of their efforts to maintain payment security.

Physical Security Breaches

Physical security breaches, such as tampering with POS devices or breaking into data centers that house payment system infrastructure, threaten the integrity of payment processing. Hotels must put protections in place that keep unauthorized individuals out of sensitive IT facilities and that safeguard payment terminals and kiosks. This requires thoughtful planning of on-premises monitoring and access controls.

Types of Payment Security

There is no one technology that will protect hotel payment processing. Hospitality businesses need a holistic plan for defense of, and fraud detection across, the payment ecosystem. Here are some of the most common security technologies and protection measures that hotels use to manage threats to their payment systems.

PCI DSS Compliance

The Payment Card Industry Data Security Standard (PCI DSS) is among the most comprehensive and well-established set of cybersecurity practices in place for protecting payment infrastructure. Governed by the PCI Security Standards Council, a collective that acts on behalf of major payment card brands and payment processors, PCI DSS establishes practices for processes, such as point-to-point encryption, to secure software development and PIN security for payment merchants and processors. These requirements set the payment security bar for any hotel that accepts credit cards.

Point-to-Point Encryption (P2PE)

Point-to-point encryption (P2PE) is a technology standard established by the PCI Security Standards Council to secure financial transactions. P2PE encrypts credit card information taken from the merchant as it is sent to the payment processor, which can decrypt it only by using a special one-time code — or secure key — that’s authorized to briefly transform the information back into the clear for processing. P2PE provides a secure way to process POS payments, preventing card data from being stolen in the clear from payment devices or during transmission.

EMV Chip Technology

EMV (Europay, MasterCard and Visa) is authentication technology that ensures that the credit cards customers use at POS terminals are real and belong to them. EMV technology, which is embedded in a chip on the card, uses cryptographic keys to protect customer data. The chip makes credit cards more difficult to counterfeit than cards that use traditional magstripe technology. The chips produce a one-time-use code when inserted into an EMV reader on a POS device. That code is used to process the payment instead of using the number printed on the card.

Tokenization

Tokenization is the process of swapping out payment information, like credit card numbers, with a special code or token that consists of a random set of characters. It is an affordable strategy that can be used to increase payment security and strengthen PCI DSS compliance. Tokenization during transactions limits the amount of sensitive data that a hotel needs to store, minimizing the risk of attackers stealing bank account data or credit card information.

Secure Payment Gateways

Payment gateways are the services that allow hotels to process online transactions by sending transaction information and authorization requests to the acquiring bank and card network. Secure payment gateways help ensure the safe execution of online transactions by encrypting card data and employing advanced fraud detection as the gateway submits data for bank verification and transaction approval.

Multifactor Authentication (MFA)

Multifactor authentication (MFA) is a crucial security measure designed to protect online transactions and accounts that facilitate online payments. MFA requires users to present multiple forms of identification before they can log into their accounts and/or execute transactions. MFA layers different forms of identity verification, including something users know, such as a password; something they have, like a smart card or a code sent to their phones; and something they are, such as a fingerprint or face.

Secure Wi-Fi Networks

The deployment of secure Wi-Fi networks is critical, not only for verifying the secure transmission of payment system information but also for providing customers with secure connections while they’re on the property and initiating transactions via their phones or other devices.

Employee Training and Awareness

Employees are the front line of protection against payment fraud and cybersecurity attacks. Employee training and awareness campaigns can help employees intelligently scan for common threats, such as phishing attacks, that could compromise payment systems; make them aware of standard operating procedures designed to prevent fraud against payment systems; and encourage a culture of security across the organization that reduces the risk of cyberattacks and payment fraud.

10 Best Practices to Secure Hotel Payments

Hotel leadership should strive for systemic strategies that minimize the risk of data theft and payment fraud. The following are technology-agnostic strategies that hotels can leverage to secure hotel payments.

1. Enforce Payment Data Minimization

Data minimization strategies shrink the threat surface by reducing the amount of data collected and retained for processing transactions. For example, merchants commonly use tokenization to minimize the amount of cardholder data they collect at POS systems. Hotels should define a data minimization standard for different payment use cases, stipulating when and how data is collected, stored and deleted.

2. Employ Fraud Detection Tools

Fraud detection tools that monitor not only payment behavior but also customer account activity detect anomalous behavior that could indicate risky or fraudulent actions. Fraud detection tools can be used to block obviously fraudulent transactions, trigger the requirement for stronger forms of authentication from customers or spur follow-up investigations by security personnel.

Fraud detection tools typically use machine learning algorithms tuned to identify malicious payment-related activity, including card-not-present fraud, chargeback fraud, account takeover attacks and account enrollment fraud.

3. Conduct Regular Security Training Workshops

Hotels should conduct regular security training workshops that help employees understand payment security and why it is important. Workshops should provide employees with pragmatic information, such as how to spot skimmers in the wild, how to avoid falling prey to phishing scams and what they need to do in the context of their roles to help the organization operate more securely. A front-desk employee, for example, requires different security information — and will face different threats — than an accounting or IT employee in day-to-day operations. Hotels may also want to test the efficacy of training, such as through the use of simulations that stress-test employee reactions to common phishing tactics.

4. Offer Secure Payment Alternatives

Hotels must strike a delicate balance between making payment systems as secure as possible and making it convenient for guests to engage in transactions. Offering secure payment alternatives for every type of transaction — whether at a POS register, a remote terminal on the property, through a hotel app or on a third-party booking website — helps hotels manage payment risks while reducing payment friction. Payment alternatives — like online payment gateways, digital wallets, and virtual credit cards — can help hotels effectively achieve that balance between strong security and exceptional guest experience.

5. Implement Access Controls

Strong access controls lay the foundation for effective hotel payment security, as well as security for adjacent systems, like hotel accounting software. Organizations need solid access controls over backend payment systems and the underlying IT infrastructure to prevent infiltration by attackers. The three core elements of strong access control are identification, authentication and authorization. Hotels should strive to enforce the rule of least privilege with their payment system access controls, using such methods as role-based access control, to ensure that users have only the minimum functionality needed to do their jobs.

6. Leverage Blockchain Technology

Blockchain technology is gaining steam as a way to securely and transparently settle and record payment transactions at relatively low cost. Blockchain payment systems facilitate complicated payments, such as cryptocurrency or cross-border transactions when accommodating international travelers.

7. Conduct Independent Security Audits

Independent security audits can identify whether payment security controls are working as intended. Hotels can use an outside provider to perform a range of security assessments, including scans of specific payment systems for vulnerabilities, penetration testing, and systemic IT audits that evaluate technology and practices to validate compliance with standards like PCI DSS.

8. Establish Incident Response Plans

In today’s complex and constantly changing security environment, breaches are the rule rather than the exception. Incident response plans are used to chart exactly how security, operations, finance and other staff will respond to the compromise of payment systems, fraudulent behavior and data breaches. Repeatable plans enable teams to think and act quickly in the heat of the moment. They provide thoughtful playbooks for stopping common attacks before they escalate, addressing the root cause of issues so they don’t occur again and mitigating the effects of fraud. Incident response plans also include the steps that must be followed to inform customers and regulators after an incident has occurred.

9. Partner With Trusted Payment Processors

The security of hotel payments depends on the safe transmission of data to and from the processor and on the security of the payment processor’s infrastructure. Hotels must, therefore, choose carefully when it comes to their transactional partners. Trusted payment processors can improve payment protections by providing secure integration with payment systems, presenting secure payment gateways and offering security-focused education and support to help merchants maintain strong security postures.

10. Promote Customer Education

Educating customers in addition to internal employees can go a long way toward safeguarding transactions and personal data. Hotels should make customers aware of the common scams that cybercriminals use, including the signs of a phishing campaign. Hotels also should clearly state how their sign-in and payment processes work, what information should and shouldn’t be shared, and what systems are in place to protect customers and their data.

Hotel Financial Management Made Easier: NetSuite for Hospitality

Mature hotel organizations understand that hotel payment security and disciplined accounting go hand in hand to maintain the financial health of the business. NetSuite for Restaurants and Hospitality provides an all-in-one accounting and business intelligence platform that helps hotels achieve transparency and operational efficiency. The cloud-based software enables one system of record for financials, inventory, POS, customer relationship management and human capital management, making it easier for hotels to connect or replace multiple point solutions. Through the platform, hotels also gain increased visibility into financial and business data, enabling leadership to make cross-platform, data-driven decisions.

Payment security is a vital discipline for hotels to minimize the risk of payment fraud and data breaches across the business. Hotels should implement a payment security strategy that prioritizes strong access control, effective encryption of sensitive information, solid network security and continuous fraud detection monitoring. Hotels also should put systems and processes in place that are designed to protect the resilience and uptime of payment processing infrastructure in the face of disruptive attacks, such as ransomware. Investing in these technologies is critical for maintaining cash flow, brand equity and reputation in the digital age.

Hotel Payment Security FAQs

Are there specific regulations or standards that hotels need to comply with regarding payment security?

The most common standard hotels must adhere to regarding payment security is the Payment Card Industry Data Security Standards (PCI DSS), used by major payment card brands. For example, depending on the incident, PCI DSS would require a hotel that suffered a security breach to participate in an independent investigation through a PCI forensic investigator.

What steps should hotels take to train staff on payment security best practices?

Hotel staff should be trained on an ongoing basis about payment security best practices. Hotels should train staff on payment processing policies and how to identify phishing attacks and other account takeover attempts that could give criminals access to payment systems. Employees also should be trained on how to spot common onsite scams, like POS skimmers.

How can hotels detect and prevent fraudulent transactions effectively?

Hotels can detect and prevent fraudulent transactions by implementing effective access control, strong data protection measures, solid network security and continuous monitoring of technology and transaction activity. Hotels also need to teach employees and customers about secure practices to prevent fraud and bolster payment security.

What are the three types of hotel payment security?

Three common types of hotel payment security are tokenization, which swaps credit card numbers with a randomized token; EMV chips, which embed authorization information in a secure chip on a credit card; and secure payment gateways, which secure information that’s routed to payment processors.

What does payment security mean?

Payment security is the discipline of using security controls to protect payment infrastructure and processes, minimizing the risk of fraud and data theft.

How does hotel payment security work?

Hotel payment security works by using technology to ensure that payment systems transmit and store payment data in a secure manner, that they accurately verify payment authorization and that they’re available when customers need to use them.