Many hotel chains are racing to replace plastic room keys with digital options, including the Apple Wallet and Google Wallet apps. Plastic hotel key cards have struggled for years. The touchless trend has accelerated during the pandemic, as touch has become taboo. And cybersecurity concerns surrounding hotel key technology have grown. Earlier this year, researchers Vulnerabilities of Plastic Hotel Keys Hackers can easily target up to 3 million keys, and it could take years to fix them.
Cybersecurity and safety concerns have prompted many hotel chains to accelerate their plans to transform hotel guest room door locks. Major U.S. chains have had digital key functionality for years, but Google Wallet and Apple Wallet are giving hotels the ability to store guests’ room keys in their wallets, allowing guests to enter their rooms by simply tapping the back of their phones on a reader near the doorknob.
Hilton hotels have an Honors app that allows guests to check in and use their room keys via their smartphones. The 119-room Harpeth Hotel in Franklin, Tennessee, is a Hilton property, and guests can check in digitally and store their keys in their Google or Apple Wallet apps.
“The beauty of digital check-in is that your phone is your key,” said Kimberly Elder, director of sales at Harpeth Hotels, adding that many guests still prefer plastic card keys.
Eli Fou, regional director of operations for Valor Hospitality Partners, which includes Hilton and Holiday Inn Express hotels in its portfolio, says digital is the next generation of hotel guestroom technology.
“The traditional hotel room key is no more,” says Fuchs.
But some security experts warn that the new locking method isn’t perfect either.
“Keyless systems can introduce a whole new threat vector to managing hotel security operations,” said Lee Clark, cyber threat intelligence production manager for the Retail and Hotel Information Sharing and Analysis Center (RH-ISAC).
Clark says these threats can be mitigated through security control policies and configurations like multi-factor authentication (MFA), but this comes with the downside of introducing an extra step that busy guests may not always want to take.
Clark said it’s unlikely all hotels will replace all key cards with digital keys anytime soon, as some guests may prefer key cards or may not have personal devices compatible with digital lock systems, and it’s expensive.
“Moving to digital and keyless locking systems requires significant costs in equipment, installation, maintenance and security,” Clark said.
Hotel chains begin demanding digital key systems
And human habits continue to get in the way.
For example, J.D. Power’s hotel survey data found that only 14% of guests at branded hotels used a digital key during their stay. Even those who downloaded the brand’s app to their phones used plastic key cards.
According to JD Power data, 30% of guests with a hotel company/brand app use digital keys and 70% Most people use plastic cards.
On the other hand, many hotels do not install digital entry locks.
“Some of the larger hotel chains with the apps most likely to support digital keys have begun requiring their hotel franchise owners to install new door locks as part of their updated brand standards,” said Andrea Stokes, J.D. Power’s hotel practice director.
Although customers have been slow to adopt digital options, J.D. Power data shows that keyless customers feel more secure than those using plastic cards.
“Guests who used digital keys rated the hotel’s security significantly more positively than guests who did not use digital keys,” Stokes said.
Chad Spensky, CEO of Allthenticate, which develops smartphone access and identity management services, compares plastic key cards to passwords, which cybersecurity experts view as low-tech and outdated.
“We all still use passwords, despite their glaring security vulnerabilities and poor user experiences. Key cards are likely to continue to be used as well,” Spensky said.
He says the real promise of digital cards lies more in convenience than security.
“The card implementation is not more secure than its plastic counterpart, but the user experience is much better,” Spensky said. Given the choice between shuffling a stack of plastic cards and having a smartphone, “the phone is the clear winner.”
Convenience factors are driving hotel chains to forge ahead in their quest for digital keys. While digital keys provide an additional attack surface, they also enable a quick course correction.
Spensky said one of the biggest problems with keycards is that there is no easy way to patch vulnerabilities once they are discovered. “With smartphones, patches can be distributed almost instantly over the air,” he said.
Don’t count your plastic key cards yet
Mehmet Erdem, No system is perfect, and people shouldn’t be lulled into a false sense of security by digital inputs, warns the professor and chair of the Department of Resort, Gaming and Golf Management at the University of Las Vegas’ William F. Harrer School of Hotel Administration.
“Everything can be hacked, everything can be compromised,” Erdem said. “If someone has the intention to hack, it will happen.”
Erdem says don’t rule out plastic key cards just yet. There are magnetic key cards that you have to swipe, and newer RFID (radio frequency identification) cards that only require proximity or can be loaded onto a phone. Erdem says that as RFID technology improves, plastic keys are becoming more versatile.
“RFID is not outdated,” Erdem said, adding that people who want to reduce interaction can download an app, get a key, activate it and then enter their room.
“Hotels will push mobile apps because of sustainability and cost,” Erdem said, but added that some people will always prefer physical plastic keys. He said the advantage of a digital version of a plastic key comes down to human nature. “People forget their wallets, they forget their IDs, but they don’t forget their phones.”
But in Las Vegas, where people often head to their hotel rooms laden with winnings from blackjack tables and slot machines, there are old-fashioned, low-tech options that make the door discussion pointless.
“There is always a safe in the room, so if guests have something very valuable they can use that,” Erdem said.
