With digital payments becoming more widespread in the lodging industry, the necessity of the safety of guest’s data is of utmost importance. Hotel industry is and has been a target of cyber threats due to the number of credit card transactions processed daily, also the reason is because they have access to sensitive consumer information such as credit card details, home addresses, phone numbers, passports, dietary preferences and more – hence, they are particularly prone to being hacked.
The security of guest’s data starts at the very first step in payment processing i.e., how the data is stored at a property. The hotels must store the data only when absolutely necessary to ensure the protection of their guests’ data. They should store only the required data and do so in a safe and secure manner.” The primary focus for any entity dealing with credit card data should be: “if you don’t need it, don’t store it”.
What is PCI DSS
The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements to protect cardholder account information. It applies to any business that accepts credit card payments and that includes the hotel industry. PCI DSS is a consistent and uniform set of standards among the five major credit card brands (Visa, Mastercard, American Express, Discover, and JCB) and provides a good basis for data security surrounding the storage of credit cards.
There are 4 levels of PCI compliance which is based on a business’ annual transaction volume and level of risk, ranging from organizations with less than 20,000 annual transactions to more than 6 million annual transactions. Furthermore, companies must comply with these standards, as non-compliance can attract fines, fees, chargebacks, and investigation costs.
Why is PCI DSS Compliance Necessary for Hotels?
The hospitality industry processes billions of dollars of transactions annually and is a prime target for hackers and financial fraudsters. Many giants of the hospitality industry have been a target of cyber-attacks in the past and it doesn’t look like it will stop any time soon. The hotels need to be on top of their digital security game to stand a chance against these attacks. Hotels are particularly vulnerable because they often store personally identifiable information and other personal consumer data generally by untrained employees especially without specialized training and end up being weak links in the security chain.
A study by Trustwave’s Spider Labs showed that of 218 data breach investigations from 24 countries, 38 percent of the attacks occurred on hotels and, of the data stolen, 98 percent was credit card information.
What Hoteliers Can Do to Keep Up with PCI DSS Standards
Hoteliers can take various measures to tighten up their digital security and comply with PCI DSS:
Training Staff:
Training the staff of hotels with the PCI protocols is utmost necessary for compliance with PCI DSS. Many hotel staff members lacking proper cybersecurity education may commit basic security mistakes, such as utilizing the default password for a system or carelessly leaving a printout or fax containing customers’ card details in plain view.
Securing Physical Data:
Ensuring that physical data is as secure as digitally stored data is an important part of PCI compliance. Hotels need to lay out guidelines for the storage and handling of physical documents containing personal information, such as scans, faxes, printouts, and notes. Staff must file away all documents containing credit card data or other personal information in a locked room or securely discard them.
Securing Network Firewalls:
It is critical to have network segmentation and firewalls separating backend systems, where customer data is stored and processed, from the hotel Wi-Fi networks used by guests or staff. Poor network segmentation makes it very easy for guests or other outsiders to hack into internal systems and access restricted data.
Conducting Regular Risk Assessments:
Businesses can hire professional agencies to perform an on-site security audit and network scan or do regular self-assessments. Conducting regular security checks is vital for maintaining a secure digital infrastructure for storing guest data.
Conclusion
To ensure the confidence and trust of the guests, it is really important for hotels to strengthen the security of their digital infrastructure so they can process the credit cards payments securely. In the competitiveness of today’s hospitality industry, it is necessary for hotels to provide digital safety to maintain the competitive edge.
Kazim Raza Ahmed is Research Analyst and Content Strategist at Advanced Hospitality Technologies, A pioneering IT Solutions partner in the hospitality industry. Being a content creator Kazim is dedicated to publishing material keeping pace with the rapid technological developments in the hospitality industry.
