Most, if not all, guest management systems in hotels use hotel key cards. Chances are you’ve probably got a hotel key card more than once in your life to access a room. You also might have some questions about how they work and how secure they are. People generally think of hotel doors as being highly secure, when in fact the technology securing them is likely out-of-date and in sore need of modernizing. Here's a complete breakdown of hotel keycards and some info that might surprise you with how vulnerable they really are to hacking, along with some suggestions on how to modernize them.
Common Hotel Card Types
Some hotels use access cards with magnetic strips, ('mag stripe cards' for short). Magnetic stripe cards are also known as 'swipe cards'. But there are other alternatives to hotel access, such as proximity (RFID) cards, access cards with holes, photo ID cards, barcode cards, and smart cards. These can be used to access rooms, use elevators and access specific areas of the building. All of these access methods are common parts of a traditional access control system.
Mag stripe or swipe cards are a cost-effective option for large hotels, but they tend to wear out quickly and are less secure than some of the other options. RFID cards are more durable and more expensive. Hole (punch) cards are based on a mechanical method that requires the holes on the card to fit the reader’s unique mechanism. These cards are less common.
All of the above examples are based on different technologies but provide the same functions for door access control. Smart cards can include a wealth of additional information about the user (whoever the card is assigned to). A smart card can be used to grant the holder access to facilities beyond the hotel room, such as restaurants, gyms, pools, laundry, conference rooms, and any other amenity that requires secure access in the building. With their enhanced security and encryption standards, smart cards collect the information from every step of the holder's journey in the facility and allow the hotel to get a joint record of all their expenses at once, rather than tallying the bills from separate places in the same building. This streamlines the financial management of the hotel and creates a smoother experience for the hotel guest.
Hotel key cards are used with door card readers installed on each door lock and can be programmed to open specific doors in defined time periods.
Modern hotel access management systems enable grouping the door locks with a number of users, providing access to the same group, as well as an audit trail of who opened the door and when. For instance, one group can have access to open the hotel lobby door or the staff toilets, but only within a certain period in the day if the administrator chooses to implement a specific window of time for access.
We mentioned earlier that smart cards could also be used to grant holders unique access to elevators. For example, if a guest has booked a penthouse suite, on a floor that should be restricted to everyday users, smart cards along with advanced door readers can make this process a breeze! To learn more about elevator access control systems specifically, check out our guide.
How do mag stripe cards unlock hotel doors?
Magnetic stripe cards have a magnetic layer or a strip which contains basic information of the hotel guest. Typically, the user access number is the most identifiable information stored on the card. Personnel at the hotel desk will imprint the user information at check-in and usually set a time limit for its use until checkout. The key card door lock is triggered once the magnetic strip is read and verified by the hotel door card reader. As a general rule, the access process is completed by swiping the card through the magnetic reader.
Note: How to re-magnetize a card
RFID or proximity cards don’t require the swiping motion. They use radio frequencies to enable access from a programmed short distance (hence the term "proximity"). RFID cards belong to the group of contactless cards. Usually for proximity cards, the user will need to almost touch the RFID reader to unlock the door.
Smart cards are also contactless cards. They use microchips to store data and although they are more expensive, they are the preferred solution for hotels seeking to modernize their processes.
Hotel Key Card Myths
The most common myths about key cards are related to the information stored on them. For example, many people believe that the cards contain sensitive user data, such as personal or financial information. The fact is, the majority of hotel key cards store only room numbers and dates of stay. While key cards do come with some risks, detailed financial information is not one of them. Additional information that can be stored on a key card comes down to four key pieces of information:
- Room number
- Date of granted access
- Date of removed access
- Guest number (on occasions)
Hotel key cards are access cards with the least amount of stored information, thus limiting the possibilities of misuse. This doesn’t protect users from having the card being stolen or lost, allowing a stranger to access their rooms before a breach is detected. This type of security lapse is more of a concern than the possibility of the information on the card being deciphered.
Although it is true that hotel key cards are not completely immune to misuse, modern data protection regulations prevent this from happening. It is worth keeping in mind that not all geographical locations have the same privacy rules. If you are traveling abroad, for example, in Europe, your card may store financial details, such as credit card numbers.
Other possible risks associated with key cards, which can not be classified as key card myths are those ensuing from third-party vendors integrated into the same guest access management system. However, these systems are also based on strict rule compliance, so breaches are not something that needs to be expected.
Alternatives to Hotel Key Cards
The technology behind most hotel key cards provides the best protection against misuse. However, smart cards, which are increasingly used in hotels, are not so easy to reset and read as magstripe cards are, making them a perfect alternative to traditional hotel key cards. Mag stripe cards record and store information on the principles of encryption. You need to have decoding readers to be able to interpret what's on them. The practice for ISO-standard cards provides storing data on three tracks on the magnetic strip, whereas hotel lock systems use a proprietary encoding pattern to encode data on the third track.
Another alternative to hotel key cards is the NFC technology integrated into mobile phones. Hotel guests receive a code from the hotel management and are able to access their rooms by either bringing the NFC phone feature close to the NFC reader or typing the code as a pass code. This method is quite new and less frequent.
Relevant Links
Bernhard Mehl
Bernhard is the co-founder and CEO of Kisi. His philosophy, "security is awesome," is contagious among tech-enabled companies.
