How to be PCI compliant in hospitality with tokenization

Hotels need personal and payments-related data from their guests. The volume and nature of the guest data make the industry a prime target for cybercrime. It should come as no surprise that the hospitality industry is the third most targeted sector by cyberattackers. 

PCI DSS is designed to protect cardholder data. It consists of 12 requirements to securely collect, process, store, and transmit the data. Because the major card schemes adopt PCI DSS, any business accepting credit card payments must comply with these requirements.

This includes businesses in the hospitality industry. Hotels are actively working to reduce their PCI scope and lower security risks. But compliance remains a demanding task.

For starters, the hotel value chain is fragmented. Hotels work with multiple partners to deliver services to guests. This includes online travel agencies, on-premise businesses like restaurants and spas, and property management systems (PMS). Sharing guest payment details among these parties exposes the data to security mishaps and errors at every stage of the guest journey.

PCI DSS is also very technical and its requirements are frequently updated. Since not all hotels have the technological resources or staff capacity to implement the necessary changes, PCI compliance becomes an expensive, time-consuming process.

What if we told you there’s a better way to protect your guest data and enhance your operations at the same time? Tokenization can help your hospitality business protect guest data as a PCI-approved security method.

What is tokenization?

Tokenization replaces sensitive or confidential information with non-sensitive ones. Personally identifiable information and payment card data are stored as tokens that contain non-sensitive data. 

Think of poker chips. They’re safe placeholders for money, allowing a casino to avoid filling the table with cash that could be lost or stolen. By themselves, the chips can’t be used as money, even if stolen. They must be first exchanged into money before they can be spent.

The same goes for payment tokens, even if the process is more technical. Tokenization replaces, or tokenizes, your guest’s confidential information and payment data with a random but unique string of numbers. 

You store and share these strings of numbers called tokens, not the sensitive data itself. 

These tokens have context-free values, meaning they don’t hint to what the underlying data is. This guarantees the anonymity of the information, ensuring privacy and security.

Automation and anonymization of sensitive data lead to better guest journeys and less work for your staff.

Let’s take it from the start. You can capture your guests’ card details in a couple of ways. You can do it online, through the booking engine on your website or via a travel agency. Alternatively, you can do it at the front desk.

You then save the data in your property management system. Instead of storing the card information as is, you replace it with generated tokens that you use for all subsequent transactions.

And from then on, you operate with tokens. You can use tokens with the PMS, where you can share them among different departments and systems and with third-party and on-premise services. This makes it easier for your staff to securely initiate payments for guests anywhere they go. 

You can also connect the tokens to any device with a near-field communication (NFC) tag, like wearables, room keys, and access cards, letting guests use them instead of their payment cards. 

This way, you create a token once, at the beginning of the guest journey, and use it throughout their entire stay, from booking to checkout, in any system you like.

It makes the payment experience faster and frictionless while maintaining PCI DSS compliance. Guests don’t have to pay with their cards at every point of sale around the hotel and can instead focus on enjoying their time.

And there’s strong evidence that this sits well with your customers. According to an in-depth study we conducted, 38% of customers in the UK were fond of using payment tokens at hotels to make purchases while keeping their wallets safe.

Your hotel can use one or more types of tokenization, like payment tokenization, proxy tokenization, and network tokenization. The most popular in the hospitality industry are the first two.

Payment tokenization is when a payment service provider, like Adyen, makes the tokenization on behalf of your hotel. We store and tokenize your guest’s primary account number (PAN) and you can use the generated tokens to offer smoother services to your guests.

Proxy tokenization is more specific to the PMS. We tokenize the payment details present in a reservation before it reaches the PMS. This reduces the PCI scope for the PMS itself.

Network tokenization is tokenization by the card schemes, and not the payment providers. Here, a card network (like Mastercard, Visa, and American Express) issues the token for your guest’s card. Because the schemes maintain the end-to-end tokenization process, network tokens are always up-to-date even if the card details expire. So if your guest forgets to update their payment information with their new PAN, they can still make the payment because of network tokens.

There are other PCI-approved security methods that are commonly used in the hospitality sector. But these lack some of the key benefits that tokenization offers.

• Data security and PCI compliance

With tokenization, you don’t store the payment card information in its original form but as tokens. This allows for secure data storage and management. It also makes PCI DSS compliance easier, more affordable, and sustainable.

• Operational agility

Tokenization also gives you additional perks for your operations. You decrease the amount of manual work for your staff. You can automate workflows and use tokens instead of manually entering card details on payment terminals or jotting them down on paper. This lowers the risk of errors and data breaches.

• Personalization and data management

You can also make use of the data by securely sharing tokens. As unique identifiers, tokens allow you to analyze guest data and draw insights from the guest’s transaction history, without compromising security and privacy. They help you to provide your guests with seamless and uninterrupted guest journeys and tailor their experiences with your hotel.

• Brand trust

For your marketing, tokenization can strengthen your business’s reputation and customer trust because of the security it offers. And finally, for your business, tokenization can boost retention rates.

Today’s digital age comes with its share of data threats to the hospitality industry. It also comes with increasing guest expectations for five-star experiences, security, and convenience.

As customer-centric businesses, hotels need to be on top of their game.

Tokenization allows you to set up PCI DSS compliant security systems that are flexible. It takes your guests, your key partners, and your business model into account, upgrading everyone’s journeys.