PCI Compliance for Hotels: Stop Taking Card Numbers by Email
Learn PCI compliance for hotels: replace emailed card numbers, paper notes, and photocopied cards with secure workflows that cut risk and audit scope.
Photo: Pixabay
On this page 8 sections
- Why Hotels Are a Favorite Target for Card Thieves
- What PCI Compliance for Hotels Actually Covers
- Risky Habits: Emails, Faxes, Sticky Notes, and Photocopies
- Taking Phone Reservations Without Exposing Card Data
- Tokenization and What It Removes From Your PCI Scope
- Hotel Front Desk PCI: Training Front Desk and Reservation Staff
- Completing Your Self-Assessment Questionnaire
- Next Steps for Your Property
Key takeaways
- Hotels usually fall out of compliance through everyday shortcuts like emailed cards, written-down phone bookings, and photocopied cards.
- Each risky habit has a compliant replacement: secure payment entry, direct-to-system keying, chip or tap at check-in, and tokenized storage.
- Tokenization and encrypted terminals can reduce how much of your property falls under PCI DSS, but you still have obligations.
- Your Self-Assessment Questionnaire should match how you actually take cards today. Confirm the correct version with your processor or a qualified assessor.
Most hotel card data problems don't start with a hacker. They start with a guest emailing a card number to the front desk, a reservationist writing a phone booking on a notepad, or a manager photocopying a corporate card "for the file." This guide to PCI compliance for hotels explains why lodging is a frequent target, which everyday habits put properties out of compliance, and the compliant workflow that replaces each one. It also covers how tokenization reduces your exposure and what to expect when you complete your annual Self-Assessment Questionnaire.
This is general information, not legal or security advice. Confirm your specific obligations with your processor and, where needed, a qualified security assessor.
Why Hotels Are a Favorite Target for Card Thieves
Hotels handle card data in more ways than almost any other small business. A single guest stay can involve:
- An online booking through your website, an OTA, or a travel agent
- A phone call to change dates or add a night
- A card-on-file guarantee for a no-show or late cancellation
- An authorization at check-in for room and incidentals
- Charges posted to the folio from the restaurant, bar, spa, or gift shop
- A final settlement at checkout, sometimes days after the card was first collected
Each of those touchpoints gives card data a chance to land somewhere it shouldn't. Hotels also keep cards on file longer than most retailers because guests often book weeks or months ahead. Front desks run around the clock with rotating staff, shared computers, and constant interruptions. Fraudsters look for exactly that mix of long data retention, many channels, and busy people.
Social engineering is another risk. Callers posing as guests, corporate travel managers, or "IT support" can pressure a night auditor into reading back a card number or emailing a folio with full card details.
What PCI Compliance for Hotels Actually Covers
PCI DSS (the Payment Card Industry Data Security Standard) applies to any business that accepts, processes, stores, or transmits card data. For a hotel, that reaches well beyond the card terminal:
- Your property management system (PMS) and any interfaces to it
- Your booking engine and website
- Phones and call recording systems used for reservations
- Email inboxes, fax machines, and shared drives
- Paper registration cards, binders, and filing cabinets
- The network your front desk computers connect to
The guiding principle is simple. Every place card data touches is in scope. The fewer places it touches, the easier compliance becomes and the less you have to protect.
Risky Habits: Emails, Faxes, Sticky Notes, and Photocopies
These habits show up at independent and franchised properties alike. Each one has a practical fix.
| Risky Habit | Why It's a Problem | Compliant Replacement |
|---|---|---|
| Guests or agents emailing card numbers | Email is unencrypted, gets forwarded, and sits in inboxes, sent folders, and backups indefinitely | Send guests to a secure booking or payment page, or take the card by phone directly into your system |
| Corporate authorization forms arriving by fax | Faxes sit in trays and get scanned into shared folders | Use a secure electronic authorization process tied to your PMS or gateway |
| Phone bookings written on sticky notes or pads | Paper gets lost, photographed, or thrown out unshredded | Key cards directly into the PMS or a virtual terminal while on the call |
| Photocopying cards and IDs at check-in | Creates a stored copy of the full card number, often in an unlocked drawer | Dip or tap the card at check-in and record only what you need, such as the last four digits |
| Writing full card numbers on registration cards | Turns every registration card into card data | Use masked numbers printed from the PMS and never handwrite card data |
| Keeping the security code "for later" | The card security code is meant only for verifying a transaction, and keeping it creates serious exposure if records are lost or stolen | Use it only for the initial authorization, never record or store it, and confirm the exact requirement with your processor |
What to Do When a Card Number Arrives by Email Anyway
You can't stop every guest from hitting "send." Set a written policy so staff know exactly what to do:
- Don't forward or print the email, and don't reply with the card number quoted.
- Reply asking the guest to use your secure booking page or to call in. Follow your processor's guidance on whether you may process card data that arrives by email.
- Delete the message from the inbox, deleted items, and any shared or archived folders. Work with your IT provider on server-side copies.
- Log the incident so you can spot repeat sources, such as a travel agency that always emails cards.
If a particular group or agency keeps sending cards by email, set up a better channel with them. Our guide to a secure third-party credit card authorization form setup walks through one approach.
Taking Phone Reservations Without Exposing Card Data
Phone bookings remain common in lodging, especially for group sales, repeat business travelers, and guests who prefer to talk to a person. You can keep taking them safely.
Key it once, directly into the system. The reservationist should enter the card straight into the PMS payment field or a virtual terminal for keyed card payments. No paper step and no "I'll enter it after the call."
Don't read numbers back aloud in a public area. A front desk phone in the lobby means other guests can hear. Route reservation calls to a back office when possible, or confirm only the last four digits.
Handle call recordings carefully. If you record calls for quality or training, card numbers spoken on the line can end up in those recordings and pull your phone system into scope. Common options include pausing recording during card capture or using a system that lets callers enter digits on their keypad without the agent hearing them. Ask your phone vendor what's available.
Lock the screen. A card left visible on a PMS screen during a shift change is an easy target. Set short auto-lock timers on front desk and reservation workstations.
Illustrative example: A 60-room independent hotel takes most of its group bookings by phone. It moves group sales calls to the back office, turns off recording during card capture, and has the sales manager key cards directly into the PMS. Paper booking sheets now carry only the guest name, dates, and the last four digits of the card.
Tokenization and What It Removes From Your PCI Scope
Tokenization replaces the actual card number with a random stand-in value, a token, that's useless to a thief. The real card data is stored by your payment gateway or processor, not in your systems. When you need to charge a no-show fee or settle a folio, your PMS sends the token and the gateway handles the rest.
For hotels, tokenization helps in several ways:
- Your PMS stores tokens instead of card numbers, so a breach of the PMS exposes far less.
- Staff see masked numbers, which removes both the temptation and the ability to copy full card details.
- Cards on file for future stays become safer, because you're holding a token rather than a raw number.
- Fewer systems handle real card data, which can simplify your Self-Assessment Questionnaire.
Pair tokenization with terminals that encrypt card data the moment a card is dipped or tapped. That keeps unencrypted card numbers off your front desk computers. Integrated payment gateways for secure online and stored-card payments and modern terminals are the foundation here. Whether your PMS supports this depends on its integration, so read up on choosing a processor that integrates with your hotel PMS before you switch anything.
What Tokenization Doesn't Do
Tokenization doesn't exempt you from PCI DSS. You still need to:
- Secure your network and front desk devices
- Control who can access the PMS and payment functions
- Train staff and handle any card data that arrives outside the tokenized flow, such as that emailed card
- Complete your annual validation
OTA virtual cards follow the same logic. Charge them through your secure system, and never copy the number into a spreadsheet. See our guide on charging OTA virtual cards from Expedia and Booking.com for the workflow.
Hotel Front Desk PCI: Training Front Desk and Reservation Staff
Technology only works if the people at the desk use it correctly. Front desk turnover is high, so training should be part of onboarding, not a once-a-year slideshow.
Cover these points with every new hire and refresh them regularly:
- Never write down full card numbers or security codes, for any reason.
- Never email, text, or chat card data, internally or to guests.
- Use your own login. Shared front desk passwords make it impossible to know who accessed what.
- Verify callers before discussing a reservation. Never read card details back to someone claiming to be the guest, a travel manager, or tech support.
- Inspect card terminals and PIN pads at the start of each shift for loose parts, overlays, or unfamiliar attached devices.
- Keep a clean desk. Registration cards, folios, and authorization forms go into locked storage, not on the counter.
- Report incidents immediately, including a card arriving by email or a suspicious call.
Night auditors deserve extra attention. They often work alone and are prime targets for pretext calls. A short laminated checklist at the desk helps. Staff who understand fraud patterns also protect card data better. Our article on spotting fraudulent bookings before arrival is a useful companion for training.
Completing Your Self-Assessment Questionnaire
Many small and midsize hotels validate PCI compliance by completing a Self-Assessment Questionnaire (SAQ), typically at their processor's request. There are several SAQ versions. The right one depends on how you accept cards and whether your systems store, process, or transmit card data. A hotel that outsources card handling to tokenized, encrypted solutions generally faces a shorter questionnaire than one whose PMS stores card numbers.
Work through it in this order:
- Map every card data flow. List each way card data enters the property: website, OTAs, phone, email, fax, front desk, and outlets. Include the "unofficial" channels you're trying to eliminate.
- Fix the habits first. Shut down emailed cards, paper notes, and photocopies before you answer questions about them.
- Confirm your SAQ type with your processor. Ask specifically how your PMS integration, terminals, and booking engine affect it.
- Gather vendor documentation. Your PMS, booking engine, and gateway providers should be able to supply their own compliance documentation.
- Check for scanning requirements. Depending on your setup, you may need periodic external vulnerability scans of internet-facing systems.
- Complete, sign, and submit the questionnaire and any attestation by your processor's deadline, and put next year's renewal on the calendar.
Franchised properties should also check brand standards, which may add security requirements of their own. If your setup is complex, with multiple outlets, a call center, or custom integrations, a qualified security assessor can help you scope correctly.
Next Steps for Your Property
Start with a one-week audit. Walk the front desk, back office, and sales office and note every place a full card number appears: inboxes, fax trays, notepads, registration cards, and spreadsheets. Replace each one using the workflows above, and update your staff training to match.
If your current setup leaves card data scattered across systems, it may be time to revisit your payment stack. MannyPay provides hotel payment processing, card terminals, virtual terminals, and gateway integrations for lodging businesses. You can request a free quote from MannyPay, and a specialist will respond within one business day to review how your property takes cards today.
This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.
