Monday, November 10, 2003
Copyright © Las Vegas Review-Journal

JANE ANN MORRISON: Hotels can't erase myth about credit card information on room keys

Web sites created to debunk "urban myths" mock the contention hotel room keys with magnetic strips can contain your credit card information.

Yet Deputy Attorney General Tracey Brierly saw it with her own eyes in South Lake Tahoe last month.

So, despite the "urban myth" tag, Attorney General Brian Sandoval is preparing to issue an advisory suggesting people retain those keys when they check out. Theorizing it is "better safe than sorry" when it comes to a potential for identity theft.

Calls to major gaming companies in Las Vegas were greeted with firm assurances that no such personal information is embedded in the credit-card style door keys now used in many resorts. But no objections were raised if customers decide they want to keep the keys.

Brierly, a deputy attorney general in the Bureau of Consumer Protection, attended a High Technology Crime Investigation Association conference in South Lake Tahoe in late October.

"Nevada is number four of all the states in terms of the numbers of complaints and incidents of identity theft," she said. So she made sure she attended one of the identity theft seminars.

The speaker asked for volunteers to provide their credit-card style room keys, the ones with the magnetic stripe. Five or six people provided their keys, and the speaker swiped them through a credit card reader.

"Two of the keys brought up a name and partial address, and another one brought up a name, address and credit card number," Brierly said. "I had no idea this was even a possibility."

Brierly said she didn't know which hotel keys had the embedded information, saying she typically leaves the key in the room upon checkout, but won't any more.

Sandoval will recommend people take and destroy that kind of hotel key, she said.

Officials at Park Place Entertainment, Mandalay Bay Resorts, Harrah's Entertainment and MGM Mirage all said no credit card information is embedded in their cards.

"At Caesars Palace, the key cards are keepsakes," said Michael Coldwell from Park Place Entertainment. Photos of Caesars Palace in 1967 and of motorcycle daredevil Evel Knievel are featured on some. "We encourage our guests to take the card."

But no credit card information is on those cards, he insisted. The cards contain the information to unlock the room but not even the name of the customer. "If someone loses a key card at a Park Place property, your identity wouldn't be known," Coldwell said.

Harrah's Entertainment's David Strow made the same assurance.

Alan Feldman of MGM Mirage said the key contains a room number and "the equivalent of a yes or no command" to identify whether the guest can charge food to the room. If customers decide to keep their keys for safety reasons, he said that won't be a problem.

As a frequent traveler, Feldman said in the future, "I'd probably ask as I check into the hotel, what information are you putting on there."

The consumer protection advice originated from the Pasadena Police Department, which e-mailed law enforcement personnel in October that a key obtained from a Doubletree hotel was found to contain a customer's name, partial home address, hotel room number, check in and out dates, credit card number and expiration date.

David Emery from the Urban Legends and Folklore Web site was told by Hilton Hotels Corp., owner of Doubletree, that the hotel key cards don't contain credit card information, and the information on them can't be read by ordinary card readers.

But that didn't mean they hadn't embedded such information several years ago.

Janet Pope, spokeswoman for the Pasadena Police Department, said Doubletree had put credit card information on their cards in the past.

"We've been assured by Doubletree they realized the glitch, and they no longer capture that information," she said.

Pope rejected the "urban myth" tag making the rounds about the keys. "It's not an urban myth; it can potentially happen."

It's not just keys that make people vulnerable, Pope said.

If that person behind the hotel desk wants to steal your identity, they can," she said. "They've got your information."

Jane Ann Morrison's column appears Monday, Thursday and Saturday. E-mail her at jane@reviewjournal.com or call 383-0271.