arlflyer

So last night I stayed at a DT on an AAA rate. Showed up, CC was on file in my Hhonors account, at the FD I present ID and AAA membership card to validate rate as is standard practice. The FD agent punches in everything, then very vigorously swipes my AAA membership card through the card reader. Ok, maybe that's part of the validation process; there is a magnetic strip after all.

10 seconds later, she leans across the desk and in a very serious tone, whispers to me "Sir, your payment was declined." Surprised, given that I use my Citi Reserve on file for all Hilton says, I say "Oh, the Visa ending blah blah expiring blah blah?" And she says, "No, the card you just gave me." I say, "Ma'am, that was my AAA membership card." She looks at me dumbfounded, and then explains that apparently my 16 digit AAA membership number has overwritten the CC number on file and they don't have access to my CC info anymore. Which is unfortunate, because I wasn't actually carrying my Reserve last night.

Turns out in the end that I had to make another dummy reservation for them to get access to my Reserve CC #, then they were able to transfer that over to the existing reservation and cancel the dummy.

All in all I found this rather hilarious, but the moral of the story is...when you hand them your AAA card, be careful what they do with it!

jabbered

A) I'm surprised that you just handed over your AAA card. I can't think of a time I've been asked for it or had to hand it over and not just show it.


B) Check-in processes for so many clerks is just automatic. You hand over a photo ID (if that) and a CC. AAA credit cards are similar (or were in the past) to the membership card. Without a close inspection, I could see how it would pass.

C) With so many different membership cards and credit cards, I'm not sure it doesn't happen with more frequency.

arlflyer

I don't use AAA rates very often - I had used one for the first time in years the night before at a different property and had been asked for the membership card. So, I just handed it over this time figuring I would be asked. Since they ostensibly would want to compare it to my ID, I just handed both over (rather than simply holding up) for simplicity's sake.


As someone who doesn't know much about the back-end IT, it's surprising to me that the number can get off the card reader, through the system, onto the reservation record, and all the way to validation before the system says "Hey, this isn't a credit card". I figured there would be some piece of data further upstream that would kick it back.

Baze

I don't hand them anything but my ID. If they ask for my AAA card (very rare) That is when I pull it out and hand it to them. They just ask, use the card on file with the res? And I say yes.

controller1

I always have my AAA card with me, but in 20 years with Hilton, Starwood and IHG I've never been asked for the card.

I would think Hilton would very rarely ask since one must enter the 16-digit number into the reservation to make a AAA rate.

arlflyer

Yes, as I mentioned I hadn't used an AAA rate in probably 5+ years before the night before the check-in I described, and at that stay I was explicitly asked for the card. So I figured it was probably universal (poor assumption with Hilton, I know), and I mean, it's not like I exactly had anything to hide.


I suppose the question would be how robust the back-end verification is between that number and the information on the reservation at the time it is made. That is, can Hilton's system talk to AAA's and see if things match up? My guess is no.

emrdoc

So you carry your AAA card and not the actually credit card you use to reserve and pay for the room? Hmm...sounds like you are asking for trouble.

I think jabbered nailed it. I doubt the clerk even looked at your AAA card before swiping it. It might be the first time any customer has ever preemptively given her their AAA card. She most likely assumed it was your CC.

Force951

You can book with any number in the AAA box. When i didn't have my card on my to get the number i would book with all 0's in the box. I expected to be asked for my card at checkin but it went through without an issue. These days i have my card number in my profile though.

arlflyer

Yes, just happened to be a coincidence in reshuffling my wallet that I left it out.


My main surprise was just that the AAA card was able to be run as a CC at all.

Baze

Not really, it is just a mag stripe on the card with the account that has the same amount of numbers as a CC (I think). It failed when it tried to call in and get the approval or when it tried to figure out the card type. A mag stripe reader is just a mag stripe reader and the Hilton software just dumped the numbers into the CC line of the reservation as it assumed it was a valid CC.

formeraa

Honestly, put yourself in the clerk's position. Credit/debit cards come in all different colors. The AAA card is the size of the credit card. It would be easy to make that mistake. When the card was scanned, it understandably overwrote the information in the credit card field.

I have to agree with the poster who commented on the fact that the OP carried their AAA card, but not their credit card. Seems a bit backward to me! I would think that the hotel would be more likely to want to see the credit card than the AAA card, but I always bring both.

Sisosig

And then every state or region has its own AAA-organisation and own memberhip card design. Some have multiple, like So-Cal vs. Nor-Cal/Utah/NV. Then there's a general AAA credit card, but some AAAs have their own.

BOSOGG

My standard issue AAA Card has an AMEX logo on both front and back. It serves as an AMEX Prepaid card, as well as AAA Membership card. It can be loaded up to $2,500 with check or cash and up to $10,000 with direct deposits. It functions like any AMEX prepaid card.

arlflyer

I guess I shouldn't be surprised that this thread quickly became about what cards I do or don't carry on a given night and the nuances of "handing" vs "showing". But mostly it was just supposed to be humor, coupled with a bit of surprise that this could actually happen. I was also surprised that a property isn't able to pull the CC associated with my Hhonors account, though I suppose that is a bit of a security measure.

sjpmurph01

I'm surprised nobody else has commented on this part of your story yet...

The fact that this hotel was supposedly able to take your full unencrypted CC info from a dummy reservation and apply it to your existing reservation is incredibly concerning. If I'm interpreting your description correctly, and this is actually what happened, then both this hotel and the Hilton website/reservation system in general are far out of compliance with PCI-DSS and PA-DSS standards. At no point should anyone, let alone a front line desk clerk at a local hotel, be able to access the full credit card information stored in Hilton's reservation system. Identifying information like the last-4 of the card number or expiration date can be accessible as a reference, but at no time should the full credit card details be so easily retrievable... which I'm assuming they were if this employee was able to "move" your card details from one res to another.

I'm not usually an alarmist about this kind of stuff, but this is a very serious security vulnerability if true, especially in light of the other ongoing HHonors account hacking saga that I still can't believe hasn't gotten more publicity (on FT or otherwise).