Live data from Hacker News

Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

news.ycombinator.com

1–10 of 20 posts

Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#1
A friend of mine has a hotel and hostel and is partner with booking.com. He received 100s of CC raw data each day.

There is no protection whatsoever. Booking doesn't manage payments on their own, they send the data clean-text directly to the hotel owner to process them using their own POS.

Is it legal? this is Masive.

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#3
they send raw credit card numbers, they dont send YOUR credit card number. They create a disposable credit card number, which they send down to the hotel, linked to your credit card. Its like a token in the form of a different credit card number. The hotel doesnt know the difference and the disposable credit card number has a fixed limit which is what you paid for your room. After that it is discarded, I dont know what happens to it afterwards. Edit: I work for a large hospitality software company, those numbers go thru us before they get to the hotel.

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#4

they send raw credit card numbers, they dont send YOUR credit card number. They create a disposable credit card number, which they send down to the hotel, linked to your credit card. Its like a token in the form of a different credit card number. The hotel doesnt know the difference and the disposable credit card number has a fixed limit which is what you paid for your room. After that it is discarded, I dont know wh…

thanks for the insight

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#5

they send raw credit card numbers, they dont send YOUR credit card number. They create a disposable credit card number, which they send down to the hotel, linked to your credit card. Its like a token in the form of a different credit card number. The hotel doesnt know the difference and the disposable credit card number has a fixed limit which is what you paid for your room. After that it is discarded, I dont know wh…

That’s actually very interesting. Thanks.

Do they do this via a partnership with MasterCard or something? Basically similar to prepaid cards?

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#7

they send raw credit card numbers, they dont send YOUR credit card number. They create a disposable credit card number, which they send down to the hotel, linked to your credit card. Its like a token in the form of a different credit card number. The hotel doesnt know the difference and the disposable credit card number has a fixed limit which is what you paid for your room. After that it is discarded, I dont know wh…

PayPal used to offer one-time use disposable CC numbers. The limit fixed at the right price is a good innovation. Thanks for sharing!

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#8
post #7

they send raw credit card numbers, they dont send YOUR credit card number. They create a disposable credit card number, which they send down to the hotel, linked to your credit card. Its like a token in the form of a different credit card number. The hotel doesnt know the difference and the disposable credit card number has a fixed limit which is what you paid for your room. After that it is discarded, I dont know wh…

PayPal used to offer one-time use disposable CC numbers. The limit fixed at the right price is a good innovation. Thanks for sharing!

My bank (Bank of America) offers this feature, but it's a bit buried in the menus. Custom limits and everything, it's pretty useful.

But there are plenty of reasons not to do business with Bank of America. I'm no shill for them.

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#9
post #8
post #7

Earlier quoted context omitted.

PayPal used to offer one-time use disposable CC numbers. The limit fixed at the right price is a good innovation. Thanks for sharing!

My bank (Bank of America) offers this feature, but it's a bit buried in the menus. Custom limits and everything, it's pretty useful. But there are plenty of reasons not to do business with Bank of America. I'm no shill for them.

Cool to know the feature exists somewhere. With the tidal wave of cryptocurrencies I'm optimistic that traditional banks will be forced to improve their customer relations, access, and transparency.

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#10
post #8
post #7

Earlier quoted context omitted.

PayPal used to offer one-time use disposable CC numbers. The limit fixed at the right price is a good innovation. Thanks for sharing!

My bank (Bank of America) offers this feature, but it's a bit buried in the menus. Custom limits and everything, it's pretty useful. But there are plenty of reasons not to do business with Bank of America. I'm no shill for them.

Thanks, I'm with BoA and didn't know about the feature (it's called ShopSafe, for others).

I like privacy.com for this purpose - works well plus it can anonymize transactions to make them opaque to the bank.

Post reply on HN