Skip to main content

Creating hostile environment for Fraud, stolen card details, chargebacks!


All, while Mews payment system, especially the automated side of it significantly improves and reduces the number of chargebacks and fraudulent payments, at the same time as I so from talking with number of you, believe that there may be some ways to improve this further. 
 
Prevention pre-arrival
3DS – this is rather tricky for any OTA reservations as Mews is not involved during the booking process, so please put pressure on OTA for to start doing 3DS on all payments and to pass on this onto Mews along with the reservations (technically possible). For example, well known OTA does have this in place but avoids doing for non-VCC reservations. 
Zero-Dollar-preauthorisation at point of booking – this would not only help verifying the card, but also alert any owner may the details be stolen at the earliest possible time – booking. 
 
Upon arrival
Chip&pin & physical card verification at the terminal – it would be great to have baked in option to automatically request the payment card to be presented and verified by the terminal upon arrival. As at the desk, so kiosks. This would prevent the most common chargebacks – card not presented. 
And in a case that the card is not matching the original card used for payment, to automatically preauthorise definable (full if required) amount. This way a lost chargeback would be possible to charge on the new card. Or alert the staff member to refund old card and charge the new one matching the guest’s gov issued photo ID (this is to be definable by the property admin and ideally mostly automated from Mews guest journey perspective).
 
Also, ideally for Mews Kiosk to recognise details (name etc) on the card and gov issued photo ID and alert staff may this not match. 
 
There of course will be cases which will slip these precautions, but why not make it for the fraudsters difficult? 
 
Please upvote if this subject is on your priority list and comment with any further improvements, suggestions on this subject.
 

We can’t use the terminals in our geography, so can’t comment on that portion of your post, but 110% agree with all of the pre-arrival notes.

Seems like there are a few relatively easy things that could be done to reduce the incidence of chargebacks. The option to force 3DS would be ideal.

 


Hey Michal,

Very painful topic and equally raising in importance as Hotel culture is changing, where the trend of Overbooking to cover for No shows is diminishing and automated and robust Canx Policies are in place.

OTA records unfortunately come as “anonymous” to the hotel. Most of the time you will get an encrypted email address which makes it difficult to make the connection of a Blacklisted profile on your PMS to a new booking via OTA.

There are couple of technical implementation that can help with Customer screening via Mews Navigator and Kiosk.

  1. You can integrate a 3rd party platform and pay additionally for Passport/ID verification. There are solutions that run the details via a secure database and confirm the person’s identity - similar to any KYC (know your customer) vetting for an Online Bank.
  2. Request with Mews to develop further their Merchant integration. Key gap on Mews’ merchant transaction platform is the lack of Address registration and verification. Any merchant can inquire about the Country of Credit/Debit card registry as well as request the Customer’s address/Post code. This is done in order for the merchant to run a check on the card that the data provided ls adequate with the person owning the card. You probably may have seen this requirement on any Online Commercial website where you will pay as a “guest” and not a registered user.

I think there is a variant where OTA doesn’t need to perform 3DS checks, we just need them to collect the correct data points and pass them to the Mews Merchant. A lot of the data passed by b.com for example doesn’t contain all the security layers and often payment is transacted as MOTO. (Not sure on the exact details here, happy to be corrected).

 

Hope this helps.

 

Igor


I agree with all the details provided in the above post; phishing emails, fraudulent cards, and malware are only becoming a larger issue for everyone. Hostelers need a joined-up systematic approach and systems innovation to help protect us from the impact on guests and loss of trust, along with the significant commercial impact.  


Hey Michal,

Very painful topic and equally raising in importance as Hotel culture is changing, where the trend of Overbooking to cover for No shows is diminishing and automated and robust Canx Policies are in place.

OTA records unfortunately come as “anonymous” to the hotel. Most of the time you will get an encrypted email address which makes it difficult to make the connection of a Blacklisted profile on your PMS to a new booking via OTA.

There are couple of technical implementation that can help with Customer screening via Mews Navigator and Kiosk.

  1. You can integrate a 3rd party platform and pay additionally for Passport/ID verification. There are solutions that run the details via a secure database and confirm the person’s identity - similar to any KYC (know your customer) vetting for an Online Bank.
  2. Request with Mews to develop further their Merchant integration. Key gap on Mews’ merchant transaction platform is the lack of Address registration and verification. Any merchant can inquire about the Country of Credit/Debit card registry as well as request the Customer’s address/Post code. This is done in order for the merchant to run a check on the card that the data provided ls adequate with the person owning the card. You probably may have seen this requirement on any Online Commercial website where you will pay as a “guest” and not a registered user.

I think there is a variant where OTA doesn’t need to perform 3DS checks, we just need them to collect the correct data points and pass them to the Mews Merchant. A lot of the data passed by b.com for example doesn’t contain all the security layers and often payment is transacted as MOTO. (Not sure on the exact details here, happy to be corrected).

 

Hope this helps.

 

Igor

Hi Igor, do you have any real life hotel experience with your 1st point? On your 2nd point, this would make perfect sense and it would prevent at least some of the chargebacks. 


Very painful topic, indeed. Our hotels have removed all automated preauthorizations and/or charges of guest cards and only allow physical card acceptance at the time of check in. The issue we have seen increase is not actual fraud or stolen credit card use, but “friendly fraud,” where guests dispute legitimate charges to get a refund. This is a significant issue in the US. Estimates state that friendly fraud accounts for 30-40% of all chargebacks. Most often, it is a cancellation fee that guests dispute, however, I have seen an increase in disputes for entire stays recently.

That being said, I am currently vetting two third party solutions: AutoHost and Canary Technologies, for additional screening options throughout the digital guest journey prior to check-in and digital check-in processes. If anyone is currently using either of these solutions and is willing to provide feedback, I would greatly appreciate it. 


In our propery we decided that all cards used for payment, must be presented at the hotel and placed in the payment terminal. If the card used for payment of a non-refundable rate is not present, we ask that the full payment will be made by check in and we make a refund on the original charge.

Using the payment terminal is proof for the card company that the card was in the hotel, as the guest must insert his pin code when approving the payment. Recently we had a request for a chargeback from a guest who used the payment terminal and the guest did not receive the money as he inserted the pin code and therefore his request for chargeback has been denied.

 

We are also using MEWS to send payment link so guests can pay online. However we have discovered that these payemnt links are not 100% guaranteed against chargebacks, so maybe MEWS should also make sure that these payment links cannot be chargedback. If this is solved, this could also be a solution against chargebacks.

 

I am not sure if Passport/ID verfications can be done in the EU. It might be against some strik data protection in the EU.

I also do not think that credit card companies will accept passport/ID verfication as a confirmation that a guest has actually made the charge. The credit card companies’ point of view is that the hotel must prove that the charge is correct. Copy of a “credit card” or a copy of ID/Passport of “card holder” is not enough and always will result in a chargeback.

 

I think that right now, the best way to avoid a chargeback is to make sure that credit card ​is presented by check in and that the card must be inserted in any payment terminal, so the guest must insert his pin code to verify the transaction.


Hello @Michal and everybody contributing to this thread! 

Thank you for this valuable feedback, I love how everybody is brainstorming about this topic! 🌟

We are also discussing this internally and will give you a Mews reaction next week! 

Thank you again! 🌸


Hi @Michal and everyone!

We really appreciate you bringing up this important topic and sharing your insights! 

We understand that chargebacks can be a significant pain point in the hospitality industry. Rest assured, we are actively monitoring this page for your valuable feedback.

Our payment product team is also working diligently to find effective solutions to minimize fraud. Stay tuned for updates and thank you for your continued support and suggestions 😊


This may be slightly off topic, please feel free to point me in another direction if this cannot be addressed here. We are currently using the Stripe terminals at my hotel, and I am interested in gaining additional access to settings and captured information. For instance, it would be great if guest could confirm address, phone and email on the terminal as well as capture signature. I know there are settings on the terminals themselves, however I do not know if these actions update the guest profile in MEWS. Nor, how to access digital signature captured.


In our propery we decided that all cards used for payment, must be presented at the hotel and placed in the payment terminal. If the card used for payment of a non-refundable rate is not present, we ask that the full payment will be made by check in and we make a refund on the original charge.

Using the payment terminal is proof for the card company that the card was in the hotel, as the guest must insert his pin code when approving the payment. Recently we had a request for a chargeback from a guest who used the payment terminal and the guest did not receive the money as he inserted the pin code and therefore his request for chargeback has been denied.

 

We are also using MEWS to send payment link so guests can pay online. However we have discovered that these payemnt links are not 100% guaranteed against chargebacks, so maybe MEWS should also make sure that these payment links cannot be chargedback. If this is solved, this could also be a solution against chargebacks.

 

I am not sure if Passport/ID verfications can be done in the EU. It might be against some strik data protection in the EU.

I also do not think that credit card companies will accept passport/ID verfication as a confirmation that a guest has actually made the charge. The credit card companies’ point of view is that the hotel must prove that the charge is correct. Copy of a “credit card” or a copy of ID/Passport of “card holder” is not enough and always will result in a chargeback.

 

I think that right now, the best way to avoid a chargeback is to make sure that credit card ​is presented by check in and that the card must be inserted in any payment terminal, so the guest must insert his pin code to verify the transaction.

I’m assuming that at checkin you preauthorise the card for some small amount, or do you have a way of avoiding initiating new transaction request and simply verify the card? Also, do you have this automated in any way or is this a policy the staff needs to follow additionally to standard checkin? Thanks


Reply