4

A hotel belonging to a large chain (400 hotels in 60 countries) has just requested me to send my credit card details via standard (unsecured) email.

I have negotiated a deal for accommodation with them, via email, outside of the standard packages available on their website, but now I need to pay their booking fee. They don't have the facility to enter an arbitrary secure payment via their website.

The issue I have is that I am convinced that whatever method I use, the hotel will probably just email it in plain text internally to some payment clerk or whatever to keep on file. So is it better to just tell them over the telephone and hope for the best?

Improve this question
3
  • I think this is a violation of PCI rules, and could cost the hotel their PCI certification.
    – MCW
    Dec 27, 2012 at 13:20
  • 4
    That's if they have a PCI certification to begin with ;)
    – Everett
    Dec 28, 2012 at 0:26
  • @dodgy_coder I'd be nice if you chose an answer... or write your own solution as an actual answer.
    – unknownprotocol
    Apr 28, 2014 at 5:42

3 Answers 3

Reset to default
6

Why not purchase a disposable Visa/ MasterCard/ Amex with the exact amount on it? Then you only have the amount they agreed to at risk. Even if something bad happens, it only happens to the funds they agreed were for the purchase.

Improve this answer
1
  • I also just came across a potential solution by PayPal. If you have a PayPal account, you can apparently generate a 'one-time' credit card number for single use, which just withdraws money from your PayPal account. Looking into it a bit further however, it seems to be no longer supported? The link to the paypal website plugin page is inactive.
    – dodgy_coder
    Dec 27, 2012 at 12:58
3

This is, unfortunately, common practice. What I fear is that they store credit card details. If you are lucky they have a centralized IT point for the whole group that's PCI-DSS compliant.

In the event that your email gets intercepted and someone steals your credit card and goes on a spending spree, it will result likely result in the following:

  1. You call your CC company and tell them someone went on a spending spree with your card.
  2. Your CC company reimburses you.

I've never had any CC company being difficult in paying back after there had been fraud with the card.

Improve this answer
1
  • Agreed, I've only ever had one fraudulent credit card transaction happen before, which I managed to charge back and get refunded by the bank. Unfortunately we probably all end up paying anyway in terms of increased c/c fees and interest rates.
    – dodgy_coder
    Dec 27, 2012 at 12:44
2

I had a hotel in Brazil email me about sending them my credit card details to pay my reservation in full and in advance, due to the World Cup frenzy.

I came up with three alternatives:

  1. Reply saying email is insecure and that you will call them.

  2. Bank of America and some other banks offer a service to their credit card customers called ShopSafe, which creates "limited credit card numbers" linked off your regular card. You setup the max limit, and the expiration date and a credit card number is generated, complete with CVV number.

  3. Buy an accepted gift card for a bit over the needed value. Larger amounts are harder to do though.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .