How Compliance Can Help Hotels Mitigate Risk
Cybercrime is becoming a common feature of the hospitality industry. Lorraine Fahy, Chief Marketing Officer at Prommt discusses how security and compliance is the cornerstone of mitigating this risk.
According to a recent cybersecurity report, nearly one-third of hotels reported a data breach in 2023, with 89% experiencing multiple breaches within the same year. The average cost? A staggering $3.4 million USD per incident.
The surge in card-not-present fraud, phishing, card skimming and chargebacks all pose a serious risk to a hotel’s brand, reputation and revenue.
The Importance of PCI Compliance
Security & Compliance is the cornerstone of mitigating this risk. The Payment Card Industry Data Security Standard (PCI DSS) exists to protect cardholder’s data and information and enforces a minimum set of security requirements on the merchant that need to be met in order to be compliant. In the event of a breach, if a hotel is not PCI compliant, the hotel is liable and may incur large financial penalties as well as brand damage. It is therefore critical for hotels to protect not only their guests but also themselves.
Reducing Scope
PCI Compliance can be challenging for any hotel. Also since April 2023, this PCI compliance has become an even bigger hurdle, with the enforcement of the new level 4 specification. A full scale audit is a long and arduous process. However, partnering with a PCI compliant payment provider will help ease this process and reduce PCI scope. For example, the process of taking card details over the phone and noting down the card number on a piece of paper or using manual credit card authorisation forms need to be eliminated and replaced with a secure online payment authorisation method. This reduces the risk of compromising guest card information, as sensitive data is not directly exchanged between guests and hotel staff. Guest card details are tokenised and securely stored with the payment gateway, eliminating the need to view or store card data locally. And for the guest, this offers a far more secure and convenient payment method. Calling out card details over the phone introduces unnecessary friction, unnecessary risk and is a negative payment experience.
Partnering with Prommt can help your hotel avoid potential security risks, reduce fraud and ensure PCI compliance. With Prommt, implementing 3DS (where available) as a security standard provides an additional layer of protection, which shifts the liability from the merchant (hotel) to the card issuer, resulting in fewer chargebacks and fraud. Secure, branded payments requests with embedded checkout links that are framed within the hotel’s website are sent via email, SMS, or chat app, keeping your guests engaged and your transactions secure.
Furthermore, Prommt empowers hotels to manage their guests’ data in compliance with Consumer Privacy Acts, TCPA, UK Data Protection Act 2018, EU GDPR, and other local regulations. If you use Oracle OPERA, Prommt’s integration with the PMS can automate payment collection for reservation bookings linked to specific booking or rate codes, such as those from OTAs or the hotel’s booking engine, helping to further reduce fraud originating from these channels.
Trusted by Top Hotels in the World
A growing number of the world’s leading luxury hotels and resorts are choosing Prommt to enable them to collect reservation and event payments safer, faster, easier and more cost-effectively. Prommt prioritises data security and is:
- PCI Level 1 Certified
- PSD2 and SCA Compliant
- Consumer Privacy Acts, TCPA, UK Data Protection Act 2018 and EU GDPR Compliant
- Stored Card Consent Token Management