A LoyaltyLobby reader sent me an email couple of weeks back about finding copies of passports and visa pages at Starwood affiliated Design hotel in Kolkata called The Park.
Here’s the email:
I’m presently at an SPG property in India. Last night, when searching for a stapler in the hotel’s Business Center I discovered hundreds of photocopies of guests’ passport photo page & visa pages left unsecured in a cabinet! Talk about identity theft opportunity! There were copies of passports from all over the world.
Or course I took photos too.
Have you ever heard of this?
I’ve also contacted the property GM but he was ‘not available’ when I went to his office just now.
We met with the GM of The Park Hotel in Kolkata, India Mr. Pramode Bhandari at 10:15am and alerted him to this concern. He seemed more embarrassed that we had discovered it rather than concerned!
There were hundreds, perhaps even thousands of photocopies of the passport pages and India visas from previous guests from more than a dozen countries. With identity theft ever-increasing, this is very disturbing as there is much personal information such as birthdate, place of birth, etc that can be used to apply or counterfeit documents. The fact these documents appear to be tossed into a cabinet left unlocked in the public business center (no hotel key needed access it) is frightening. We discovered it when we opened the cabinet (it was ajar) to find some more paper for the printer.
We just checked the cabinet in the business center at 5:45pm (7 hours after alerting the GM, who said a “staffer isn’t doing their job” and he would look into it) and the cabinet is still unlocked and the photocopies are still there. We are checking out tonight (Friday 10 Feb in Kolkata) and are now very curious how secure our passport photocopies will be once we check out and the folios possibly tossed into the cabinet, as I am sure you can imagine.
This is horrible.
When the reader sent this, I was about to check in to the Holiday Inn Express hotel in Phuket (blame those cheap MH fares of last year) and they had their front desk loaded with passport copies.
The reader here has legit concern. What is the retention policy of these copies taken and who is responsible for properly storing them?
Hotels seem to:
1. Don’t ask for any kind of ID especially if you are a regular guest
2. Merely check your ID and don’t record anything
3. Record the ID or passport number and usually your birth date to the system
And then we come so something that I don’t like:
4. Take photocopy of your passport info page and the arrival stamp or visa page
5. Scan these two pages to the system such as Micros
6. I have even been asked by front desk to take copy of the info page on regular digital camera
The problem with 4 to 6 is that I have absolutely ZERO faith that these hotels have any kind of policy in place how long the information is stored and how they are purged (if they are purged at all).
Hotel employees have access to your personal and credit card information. Combined this with more detailed information found from the IDs, passports and visas, it would not be difficult to someone engage in identity theft.
Here’s the response that I received form the Marriott spokesperson:
At Marriott, we take the matters of privacy and security of personal information very seriously. Marriott International, Inc. does not own, operate or manage the Park Hotel Kolkata. The hotel participates in the Starwood SPG program through its relationship with Design Hotels. We have been informed by Design Hotels that they are addressing this matter.
I have been given a fax (remember those times?) when someone was recycling paper (this was Marriott Buenos Aires) and found the hotel’s account receivables on the other side. Last year, Sheraton hotel in South America gave me some information and had guests names and room numbers on the other side.
Hotels really should pay more attention how personal information is stored. Considering that most if not all the hotels have had their systems hacked over the past few years and the credit card information stolen (usually at the F&B and other outlets) and later traded on the dark web, I doubt that there are proper policies in place or they are not followed.
All the chains have gone asset light and don’t own most of the properties carrying their flags. It is easy to blame these operators in case something goes wrong as illustrated on the response above too.