How do I stop stolen-card bookings at my hotel?

Hotels see a kind of stolen-card fraud most shops never do: rooms prepaid with stolen card numbers and resold to real travelers. Below: how these bookings work, the warning signs your front desk can catch, and the payment settings that move the loss off your books.

How do stolen-card bookings work at a hotel?

The scheme starts with a room prepaid on a stolen card number, then sold to a traveler for cash. Elavon's fraud team describes it. Fraudsters prepay rooms at attractive hotels with compromised cards, then resell the bookings to travelers who pay them directly.

A 2025 federal case in Minnesota shows how it runs in the U.S. A woman who "operated as a black-market travel agent" bought card data for about 216 victims on the dark web. She booked hotel rooms and rental cars with it. Her customers paid her a fraction of the actual booking costs, by payment app or cash.

The guest at your desk may be a real traveler who thinks they got a deal. The cardholder disputes the charge later, and the hotel has already given away the room.

What other stolen-card schemes hit hotels?

Two more patterns are specific to lodging. Elavon lists both in its hotel fraud guidance.

The cancel-and-redirect scheme can cost the most. Elavon notes it leaves the hotel with a double loss: the refund it sent out and the chargeback from the real cardholder.

What warning signs should my front desk and reservations team watch for?

Watch for card swaps, unconcerned big spenders and contact details that don't fit. Elavon's list of warning signs:

• New card numbers offered right after a decline, especially several in a row
• Little concern about a high booking cost
• Free or mismatched email addresses that don't fit the guest's name

Add one hotel-specific check: the name on the reservation versus the person standing at the desk. A third party checking in on a prepaid room is the resale pattern in action.

Will AVS and CVV checks stop these bookings?

Not on their own. In the Minnesota case, the stolen data included names, addresses, card numbers, expiration dates and the CV2 codes, according to the Justice Department's release. A fraudster holding all of that can pass an address and security-code check.

The same goes for the daily card validation some hotel groups recommend. Preferred Hotel Group advises reviewing the previous day's bookings and placing a small authorization on each card to confirm the number is valid. That weeds out made-up numbers. A live stolen card will still approve.

What actually moves the fraud loss off my hotel?

Authenticating the cardholder online, and dipping the chip in person. Those are the two steps that change who pays.

Online prepaid bookings: 3-D Secure. Elavon's newer EMV 3-D Secure checks the cardholder in the background. The guest doesn't have to take part in the risk check. Elavon says it shifts e-commerce-only fraud liability to the card-issuing bank, in an article republished by the Washington Hospitality Association. It applies to bookings made through your own website or booking engine, not to cards keyed by phone.

At check-in: see the card and dip the chip. Elavon advises asking guests to present the card used for a prepaid booking. If they can't, refund the original charge to that card and ask for another payment. Then run the new payment as a chip transaction at the desk. Visa's counterfeit liability shift took effect in the U.S. on Oct 1, 2015. It holds the party that caused a chip transaction not to happen liable for counterfeit losses. Swiping or keying a chip card at the desk gives that protection away.

On cancellations: refund to the original card. Visa's refund guidance says to process the refund to the account number used in the original purchase. Make it a written policy so no agent can be talked into sending a refund somewhere else.

Example: what one stolen-card booking can cost a hotel

This is a hypothetical example, not a real hotel's numbers.

A guest books three nights online at $189 a night and prepays. With taxes, the charge comes to $650. Two days later, the guest cancels and asks for the refund to "a new card" because the first one was "lost."

Refunding only to the original card turns this into a $0 loss. The refund goes back to the stolen card, and the real cardholder has nothing to dispute.

Now take the resale version. A traveler who bought the same $650 room from a "travel agent" arrives without the booking card. If the desk refunds the booking and takes a chip payment from the guest, the hotel keeps the room revenue. If not, the hotel loses $650 and a night it could have sold.

Can I win the chargeback when the guest was the real cardholder?

Sometimes, if they're a repeat direct guest. Visa's Compelling Evidence 3.0 lets a merchant answer a card-absent fraud dispute with prior history. Visa's October 2026 dispute guidelines call for at least two earlier undisputed transactions. They must fall between 120 and 365 days before the disputed one. They also need matching identifiers, such as email, device ID or IP address.

That helps when a returning guest books direct and later claims they didn't. It won't help with a true stolen card, which has no history with your hotel. Prevention at booking and check-in matters more there.

How does card fraud affect when my hotel gets paid?

Chargebacks pull money back out after a sale has already been funded to your account. Our guide to how fast card sales hit your bank account covers funding timing and what can slow deposits down.

When BP Global Merchant Services fits

BP Global is a Dallas-based Elavon Payments MSP that works with merchants across the U.S., including hotels. We process behind Oracle OPERA, through gateways such as Authorize.net and NMI, and on EMV chip terminals for the front desk. Every merchant gets a dedicated case manager who fights chargebacks, 24/7 support and managed PCI DSS compliance through VikingCloud. To see what fraud and chargebacks cost your hotel now, start with the Free Statement Review.