Credit card security #2 - now the question is about Premier Inn (UK)

I wrote a couple of weeks ago about the PCI standards required for storage and distribution of credit card data within large hotel distribution OTAs (Online Travel Agents) (see original article)

Anyway, last week I went to the 7th eTourism Futures forum at Bournemouth University - and stayed in a new Premier Inn hotel (Bournemouth East) (10th April). Not a bad hotel actually….. Normally I prefer any hotel owned by Accor (as I get to watch French television) but Premier Inn have Freeview…. an interesting dilemma.

One thing that struck me was that the credit card payment system (for entering in pin numbers) was in full view of the internal CCTV camera. Not only that, but the reception CCTV signal was broadcast, live, to a monitor in the public bar.

This means that any member of the public could, while waiting at the bar, see newly arriving hotel guests enter their pin numbers…. not exactly ideal. 

What does PCI say about CCTV cameras?
I couldn’t find anything specifically in the standard about recording PIN number entry probably because PCI doesn’t extend to that part of the process. However, I have found some interesting quotes on the web….

From Silicon.com 

Tesco - “Generally the customer will be standing in front of the PIN terminal so we don’t see that it poses a risk”

eh? So Tesco (a large supermarket chain) rely on good luck that PIN entry is obscured by someone between the camera and the PIN entry machine.  

British Retail Consortium -  described it as a form of “electronic shoulder-surfing” but said that retailers can minimise the risk by taking sensible precautions and positioning the PIN pads away from cameras

On the APACS (The UK payments association) website there is this PDF which contains the following advice:

Cameras must be fixed so that a customer’s PIN cannot be identified. Access to CCTV footage should be restricted to authorised staff

So Premier Inn….. I think you have some work to do! 

Next steps
I have completed a feedback card (at the hotel)….. lets see if I get any communication from Premier Inn. Apparently I was the first person to complain about this!

If you want to be notified next time something is published sign up for email alerts or subscribe to the RSS feed. Thank you for reading!