Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#11

Post by pmulv »

e1g wrote: post #10
cjmoran wrote: post #8

Earlier quoted context omitted.

My bank (Bank of America) offers this feature, but it's a bit buried in the menus. Custom limits and everything, it's pretty useful. But there are plenty of reasons not to do business with Bank of America. I'm no shill for them.

Thanks, I'm with BoA and didn't know about the feature (it's called ShopSafe, for others). I like privacy.com for this purpose - works well plus it can anonymize transactions to make them opaque to the bank.

I love privacy.com - I can kill the debit cards I generate and use with specific merchants when they have been exploited.

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#12

Post by ezekg »

its_trivial wrote: post #3

they send raw credit card numbers, they dont send YOUR credit card number. They create a disposable credit card number, which they send down to the hotel, linked to your credit card. Its like a token in the form of a different credit card number. The hotel doesnt know the difference and the disposable credit card number has a fixed limit which is what you paid for your room. After that it is discarded, I dont know wh…

For the curious, there's an API for that: https://www.marqeta.com/

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#13

Post by GFischer »

its_trivial wrote: post #3

they send raw credit card numbers, they dont send YOUR credit card number. They create a disposable credit card number, which they send down to the hotel, linked to your credit card. Its like a token in the form of a different credit card number. The hotel doesnt know the difference and the disposable credit card number has a fixed limit which is what you paid for your room. After that it is discarded, I dont know wh…

Very interesting:

https://partnerhelp.booking.com/hc/en-us/articles/213317965-...

When a guest makes a booking and is being charged on your behalf, you'll receive a virtual credit card from an external payment provider along with the booking details. This card gives you access to the exact amount, and you can charge it according to the charge date. Paid online will show in the Status column on the Extranet’s Reservations page, showing that the guest has been charged on your behalf.

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#14

Post by kstenson »

ezekg wrote: post #12
its_trivial wrote: post #3

they send raw credit card numbers, they dont send YOUR credit card number. They create a disposable credit card number, which they send down to the hotel, linked to your credit card. Its like a token in the form of a different credit card number. The hotel doesnt know the difference and the disposable credit card number has a fixed limit which is what you paid for your room. After that it is discarded, I dont know wh…

For the curious, there's an API for that: https://www.marqeta.com/

Does anyone know if there is a uk company that offers this service?

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#15

Post by boysabr3 »

kstenson wrote: post #14
ezekg wrote: post #12

Earlier quoted context omitted.

For the curious, there's an API for that: https://www.marqeta.com/

Does anyone know if there is a uk company that offers this service?

I think this is what https://www.wavecrest.gi/ does. But haven't heard great things about them.

Shift payments is another option in the US - don't think they're in the UK either.

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#16

Post by boysabr3 »

chatmasta wrote: post #5
its_trivial wrote: post #3

they send raw credit card numbers, they dont send YOUR credit card number. They create a disposable credit card number, which they send down to the hotel, linked to your credit card. Its like a token in the form of a different credit card number. The hotel doesnt know the difference and the disposable credit card number has a fixed limit which is what you paid for your room. After that it is discarded, I dont know wh…

That’s actually very interesting. Thanks. Do they do this via a partnership with MasterCard or something? Basically similar to prepaid cards?

They should be using an issuing processor (a financial institution that works with Visa or MasterCard) to issue card numbers. Issuing processors can easily generate card numbers programmatically + on the fly.

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#17

Post by boysabr3 »

I think you have the answer already and IANAL but just to add on, in most countries this a matter of PCI compliance that is enforced by the card networks. In most countries it's not a criminal offence to be PCI non-compliant (but you could be liable for civil suits and fines by the card schemes).

I imagine there's a clause in the PCI compliance rules that allows raw card numbers to be sent less securely if they are virtual + single use card numbers or maybe if the liability of fraud on those card numbers doesn't fall on the "original" card holders.

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#19

Post by hairyjewbear »

its_trivial wrote: post #3

they send raw credit card numbers, they dont send YOUR credit card number. They create a disposable credit card number, which they send down to the hotel, linked to your credit card. Its like a token in the form of a different credit card number. The hotel doesnt know the difference and the disposable credit card number has a fixed limit which is what you paid for your room. After that it is discarded, I dont know wh…

I have picture proof this is false

Re: Ask HN: Booking.com sends raw CC data to Hotels. Is it legal?

#20

Post by chatmasta »

boysabr3 wrote: post #16
chatmasta wrote: post #5

Earlier quoted context omitted.

That’s actually very interesting. Thanks. Do they do this via a partnership with MasterCard or something? Basically similar to prepaid cards?

They should be using an issuing processor (a financial institution that works with Visa or MasterCard) to issue card numbers. Issuing processors can easily generate card numbers programmatically + on the fly.

Thanks for the info. I haven’t heard the term issuing processor before.
Post reply on HN