Comment The real story (Score 1) 416
Probably one of the first times I've been able to comment on /. about MY field - the manufacture of plastic cards. As a former owner of one of the USA's leading suppliers of magnetic stripe cards (hotels, casinos, universities, etc.) I can say 100% that this story is FALSE!
Magnetic hotel keys only hold a small amount of information on one track of the magnetic stripe. This is typically limited to a code for the lock, the number of days of stay (or exp date), and sometimes the number of keys issued. There is no need for any additional information (nor the liability that would come with it). Any system that is using a keycard to auto-charge to a room is simply doing a database lookup of the account to charge the card on file. The only risk when losing your key is during your stay - someone will randomly find your room or attempt to charge a meal/etc. to your account. Both of these are EXTREMELY rare occurences.
It's been my view that this rumor is a combination of the misunderstanding of how hotel room keys work and the real threat of hotels using magnetic key cards - which is the 'duping' of actual credit card information to the key card. Hotel key cards are commonly used as 'blanks' to copy real credit card data (both tracks) to be used in machines that do not require a signature or teller attendence (gas pumps, etc.). The technology of both mag stripes are identical (albeit made of different materials) - the room keys are simply a 15-year old version of a credit card stripe - and since readers are typically made backwards compatible, they will perform just fine. I used to regularly give demonstrations in our plant using a commonly available mag stripe reader/encoder on how quick a MC/Visa could be copied (about 3 seconds). It's because of the availability of 'blank stock' now that many gas stations now ask for your zip code at the pump or require you to take it inside to show someone. Imagine if toilet paper were made from the same cotton paper our currency is printed on - that's the exact problem the credit card companies have. They can add all the security features they like to the card (and there are MANY), but if there isn't someone validating the card visually, then it is just too easy.
OK, babbled a little off-topic, but I believe it's a combination of these two issues that has cause this 'urban legend'. We also see the same story "if you buy a gift card with a credit card". Again, not true.
Magnetic hotel keys only hold a small amount of information on one track of the magnetic stripe. This is typically limited to a code for the lock, the number of days of stay (or exp date), and sometimes the number of keys issued. There is no need for any additional information (nor the liability that would come with it). Any system that is using a keycard to auto-charge to a room is simply doing a database lookup of the account to charge the card on file. The only risk when losing your key is during your stay - someone will randomly find your room or attempt to charge a meal/etc. to your account. Both of these are EXTREMELY rare occurences.
It's been my view that this rumor is a combination of the misunderstanding of how hotel room keys work and the real threat of hotels using magnetic key cards - which is the 'duping' of actual credit card information to the key card. Hotel key cards are commonly used as 'blanks' to copy real credit card data (both tracks) to be used in machines that do not require a signature or teller attendence (gas pumps, etc.). The technology of both mag stripes are identical (albeit made of different materials) - the room keys are simply a 15-year old version of a credit card stripe - and since readers are typically made backwards compatible, they will perform just fine. I used to regularly give demonstrations in our plant using a commonly available mag stripe reader/encoder on how quick a MC/Visa could be copied (about 3 seconds). It's because of the availability of 'blank stock' now that many gas stations now ask for your zip code at the pump or require you to take it inside to show someone. Imagine if toilet paper were made from the same cotton paper our currency is printed on - that's the exact problem the credit card companies have. They can add all the security features they like to the card (and there are MANY), but if there isn't someone validating the card visually, then it is just too easy.
OK, babbled a little off-topic, but I believe it's a combination of these two issues that has cause this 'urban legend'. We also see the same story "if you buy a gift card with a credit card". Again, not true.
