The short answer to what info is stored on your hotel key card: a room number, the dates of your stay and a few codes the door lock reads. Your credit card number is not on it. A Computerworld investigation published in January 2006 tested 100 hotel cards, and none held personal details that an identity thief could use.
The old warning email about key cards and identity theft has done the rounds for more than twenty years, so it is worth knowing what is really on the card, what is not, and the one real security problem, which has nothing to do with your name.
What Info Is Stored on a Hotel Key Card?
At check-in the front desk system encodes the card with a room number, a lock code to open the door and the start and end dates of your stay. The property management system also creates a guest account number, sometimes called the folio, and passes it to the lock system, which writes it onto the card.
Cards can carry one more item: a yes or no flag saying whether you can charge food to your room. The flag does not hold a card number. It only tells the till that the hotel has you on file.
Does a Hotel Key Card Store Your Name or Credit Card Number?
Your credit card number is not stored on a key card. Payment details stay in the hotel’s own system. Disney’s MagicBand works the same way: it identifies your account while payment details stay in the hotel’s system.
Here is the list of what sits on the card and what does not.
Your name is less clear. Some magstripe systems may store the guest’s name, while Computerworld found no personal information on any card it tested. Treat the name as possible on some systems, and treat your card number, address and ID as never there.
Where Did the Hotel Key Card Identity Theft Warning Come From?
A warning email claiming that hotels put guest names, addresses and credit card details on key cards started circulating in 2003. It was later found to be inaccurate, because the personal details on the cards in question had not been put there by hotels.
Computerworld tested the claim properly. Staff collected 52 cards over six weeks, and the card reader maker MagTek added more from its own staff, for 100 in total. MagTek’s engineer could pull binary data off them but could not decode it. Most cards were unreadable with an off-the-shelf reader, only 15% yielded any data and none contained personally identifiable information.
Can Someone Read Your Old Key Card?
A thief with an ordinary card reader will mostly get nothing. The cards are encrypted and use proprietary encoders and readers, and the lock stops accepting a card once its stay dates end or the room is encoded for the next guest. Your personal data is not at risk if you walk off with one, though on some older locks a used card can still help an attacker forge keys (more on that below).
The card holds nothing about you either. Keep it, bin it or, better still, hand it back. Cutting it up is optional. Before you pack, it is worth checking the hotel room items travellers often take home by mistake.
The Real Risk: Hotel Key Card Lock Hacks
The more realistic weakness sits in the lock, not in your data. In 2024, researchers disclosed Unsaflok, a set of flaws in dormakaba Saflok locks. More than 3 million locks in 131 countries were affected, and an attacker needed to read only one card from the property, which could be an expired card taken from an express checkout box, to forge keys that opened rooms.
Dormakaba began its fix in November 2023, and by March 2024 an estimated 36% of the affected locks had been updated or replaced. The researchers reported no confirmed use of the attack in the wild, but they could not rule it out.
The lesson is a wee one. Your personal data was never at risk from an old card, but a card can still stand in for a key to a room until the lock stops accepting it. Two habits cost nothing:
- Use the deadbolt or security latch whenever you are in the room.
- Report a lost or stolen card to the front desk at once so the hotel can issue a new one.
We earn a commission if you buy through this link, at no extra cost to you.
What To Do With Your Key Card After Checkout
Return it at the desk if the hotel asks, or leave it in the room. If you keep it, your data is not on it.
If your next stay is already on the list, this is a good time to check what you left signed in on the hotel TV, which is a likelier source of leaked personal data than the card.
Frequently Asked Questions
Do Hotel Key Cards Contain Credit Card Information?
No. A hotel key card carries a room number, stay dates and lock codes, and payment details stay in the hotel’s own system.
Is It Safe To Keep a Hotel Key Card?
Yes. A kept card holds none of your personal details, and the lock stops accepting it after your stay ends. On some older lock systems a used card could help an attacker forge keys, so handing it back at the desk is the tidier option.
Can a Hotel Key Card Be Cloned?
On some older lock systems, yes. The Unsaflok flaws in dormakaba Saflok locks let attackers forge keys from a single card read, and the manufacturer has been updating or replacing the affected locks since November 2023.
Why Does My Hotel Key Card Stop Working?
The card carries the end date of your stay, so it stops opening the door once your checkout time passes. It also stops working if the desk encodes a new card for your room, which cancels the old one.
