How to secure CC details and CCV for a small hotel?

Question

I got a weird case here, where there is a small hotel using booking.com to receive reservations.

All of the reservations are coming in, through booking.com, but most of them are not book now - pay now. They are sort of book now, pay later.

Booking.com shows that persons credit card information on plain sight for the owner, but the CCV information is only shown once with a press of a button, then it disappears. CCV is also available on booking.com for something like 72 hours after the reservation, it then gets deleted.

The issue with the owner is, that he needs to store the credit card details and the CCV somewhere, to have some sort of security against no-show.

So atm, the owner is taking a note of the CCV and stores it in a paper form.

I was asked to help around with making this process less painful, but really stuck since I got no idea about credit cards and PCI compliance on this specific case.

Any ideas on how I can make my clients life easier? How can we safely store credit card details including CCV until the client has stayed in the hotel and then delete them? Is it even legal? What should I do in this case?

Also this hotel used to do everything in usb sticks etc, I am trying to move them to a dropbox solution, but as soon as I heard about credit card information being stored I had a 2nd thought and said no. Please enlighten me.

Answer 1

How can we safely store credit card details including CCV until the client has stayed in the hotel and then delete them? Is it even legal?

It is not. You cannot purposefully store this information, allowed storage is the few seconds needed for the hotel to forward it to the bank to check its validity. If he stores the CVV in any way which would let him send it without the cardholder entering it, then that is a violation. Him writing it down as 'insurance' is a violation.

CVV numbers are not needed to process the transaction, they are just another layer of protection against fraud. The hotel owner may only use it to verify the owner of the card. If the hotel owner uses the CVV number in the charge it denies the card owner the ability to successfully charge back an unauthorized transaction since the Credit Card company will deny the chargeback.

What would make his life easier is getting a downpayment that people forefeit if they don't show up.