|
By Robert Siciliano, IDTheftSecurity.com
Personally, I don’t particularly enjoy staying in hotels. Sure, after a long day of travel, the hotel is a relief, but in most cases, I’d much rather sleep in my own bed. Criminal hackers, on the other hand, love hotels.
According to a recent study, 38 percent of all credit card breaches occur in hotels. Despite several high-profile breaches that recently affected payment processors and banks, the financial services industry only accounts for 19 percent of breaches. Retailers came in third at 14 percent, and restaurants fourth at 13 percent.
Over the past five years or so, I’ve noticed a trend in which criminals go after the most likely targets, and those victims beef up their defenses in response. So the bad guys move on to the next most likely target -- one that hasn’t learned from others’ mistakes.
Hotels are easy targets because they are all credit card-based. It is possible to reserve a room without providing a credit card number, but they don’t make it easy. And hotels themselves certainly aren’t fortresses designed to keep bad guys out. They’re designed to be open and inviting, with, at best, a bellman whose focus is assisting guests rather than guarding the front door. Maybe that mentality exists in hotels’ IT security departments too.
The root of the issue is the hotel industry’s insufficient security measures to prevent data breaches. Many rely on older point-of-sale terminals and outdated operating systems, which are more vulnerable to hackers.
When the recession hit, many hotels cut back and decided to hold off on upgrades. While their defenses were down, hackers slithered into their networks to steal guests’ personal financial data. Once thieves have accessed this data, they can clone cards with the stolen numbers and use them to make unauthorized charges.
As a consumer, your only recourse is to pay close attention to every single penny charged to your credit card, and dispute any fraudulent or incorrect transactions, no matter how small. Check your statements frequently and be sure to dispute all unauthorized charges within two billing cycles, or 60 days.
Canada and Mexico have adopted smart cards, which use “chip and PIN” technology, making the credit card data useless to potential identity thieves. Eventually we may see the adoption of smart cards in the U.S., which would put an end to this madness.
This article was published by Infosec Island.
Robert Siciliano is an expert on personal security and identity theft and the CEO of IDTheftSecurity.com.
Only registered users can write comments.
Please login or register. |
